aboutsummaryrefslogtreecommitdiff
path: root/hw
diff options
context:
space:
mode:
authorAlistair Francis <alistair.francis@xilinx.com>2016-06-27 15:37:32 +0100
committerPeter Maydell <peter.maydell@linaro.org>2016-06-27 15:37:32 +0100
commitf265ae8c79ce8c194de481e9def1daa3a80dbb96 (patch)
tree29d38fee3b74d00b5a8652d75a57af742f4a9703 /hw
parentf6cf41932edf260c2574346a08358ad2d20c357e (diff)
downloadqemu-f265ae8c79ce8c194de481e9def1daa3a80dbb96.zip
qemu-f265ae8c79ce8c194de481e9def1daa3a80dbb96.tar.gz
qemu-f265ae8c79ce8c194de481e9def1daa3a80dbb96.tar.bz2
cadence_gem: Avoid infinite loops with a misconfigured buffer
A guest can write zero to the DMACFG resulting in an infinite loop when it reaches the while(bytes_to_copy) loop. To avoid this issue enforce a minimum size for the RX buffer. Hardware does not have this enforcement and relies on the guest to set a non-zero value. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Reported-by: P J P <ppandit@redhat.com> Message-id: 84bb1c391b833275da3f573d4972920cea34c188.1466539342.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw')
-rw-r--r--hw/net/cadence_gem.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 0346f3e..e5f3c985 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -664,6 +664,13 @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
GEM_DMACFG_RBUFSZ_S) * GEM_DMACFG_RBUFSZ_MUL;
bytes_to_copy = size;
+ /* Hardware allows a zero value here but warns against it. To avoid QEMU
+ * indefinite loops we enforce a minimum value here
+ */
+ if (rxbufsize < GEM_DMACFG_RBUFSZ_MUL) {
+ rxbufsize = GEM_DMACFG_RBUFSZ_MUL;
+ }
+
/* Pad to minimum length. Assume FCS field is stripped, logic
* below will increment it to the real minimum of 64 when
* not FCS stripping