Commit f265ae8c authored Jun 27, 2016 by Alistair Francis Committed by Peter Maydell Jun 27, 2016

cadence_gem: Avoid infinite loops with a misconfigured buffer



A guest can write zero to the DMACFG resulting in an infinite loop when
it reaches the while(bytes_to_copy) loop.

To avoid this issue enforce a minimum size for the RX buffer. Hardware
does not have this enforcement and relies on the guest to set a non-zero
value.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reported-by: Li Qiang <liqiang6-s@360.cn>
Reported-by: P J P <ppandit@redhat.com>
Message-id: 84bb1c391b833275da3f573d4972920cea34c188.1466539342.git.alistair.francis@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

parent f6cf4193

hw/net/cadence_gem.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -664,6 +664,13 @@ static ssize_t gem_receive(NetClientState nc, const uint8_t buf, size_t size)
		GEM_DMACFG_RBUFSZ_S) * GEM_DMACFG_RBUFSZ_MUL;
		bytes_to_copy = size;

		/* Hardware allows a zero value here but warns against it. To avoid QEMU
		* indefinite loops we enforce a minimum value here
		*/
		if (rxbufsize < GEM_DMACFG_RBUFSZ_MUL) {
		rxbufsize = GEM_DMACFG_RBUFSZ_MUL;
		}

		/* Pad to minimum length. Assume FCS field is stripped, logic
		* below will increment it to the real minimum of 64 when
		* not FCS stripping