Commit 81f17e0d authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Jason Wang
Browse files

net: imx: limit buffer descriptor count 



i.MX Fast Ethernet Controller uses buffer descriptors to manage
data flow to/fro receive & transmit queues. While transmitting
packets, it could continue to read buffer descriptors if a buffer
descriptor has length of zero and has crafted values in bd.flags.
Set an upper limit to number of buffer descriptors.

Reported-by: default avatarLi Qiang <liqiang6-s@360.cn>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
parent a935cc31

hw/net/imx_fec.c

+6 −4
Original line number Diff line number Diff line
@@ -55,6 +55,8 @@ 
        } \

    } while (0)



#define IMX_MAX_DESC    1024



static const char *imx_default_reg_name(IMXFECState *s, uint32_t index)

{

    static char tmp[20];
@@ -402,12 +404,12 @@ static void imx_eth_update(IMXFECState *s) 


static void imx_fec_do_tx(IMXFECState *s)

{

    int frame_size = 0;

    int frame_size = 0, descnt = 0;

    uint8_t frame[ENET_MAX_FRAME_SIZE];

    uint8_t *ptr = frame;

    uint32_t addr = s->tx_descriptor;



    while (1) {

    while (descnt++ < IMX_MAX_DESC) {

        IMXFECBufDesc bd;

        int len;
@@ -453,12 +455,12 @@ static void imx_fec_do_tx(IMXFECState *s) 


static void imx_enet_do_tx(IMXFECState *s)

{

    int frame_size = 0;

    int frame_size = 0, descnt = 0;

    uint8_t frame[ENET_MAX_FRAME_SIZE];

    uint8_t *ptr = frame;

    uint32_t addr = s->tx_descriptor;



    while (1) {

    while (descnt++ < IMX_MAX_DESC) {

        IMXENETBufDesc bd;

        int len;