From nobody Tue Jun 11 18:51:20 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=gmail.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1673259637405109.60064563260403; Mon, 9 Jan 2023 02:20:37 -0800 (PST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pEpG8-0002AL-4W; Mon, 09 Jan 2023 05:20:04 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pEpG2-00028L-VD for qemu-devel@nongnu.org; Mon, 09 Jan 2023 05:20:00 -0500 Received: from [183.159.98.38] (helo=liuqiang-OptiPlex-7060) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pEpFz-0007Dm-BU for qemu-devel@nongnu.org; Mon, 09 Jan 2023 05:19:57 -0500 Received: from localhost (liuqiang-OptiPlex-7060 [local]) by liuqiang-OptiPlex-7060 (OpenSMTPD) with ESMTPA id 9a122eb5; Mon, 9 Jan 2023 09:19:51 +0000 (UTC) From: Qiang Liu To: qemu-devel@nongnu.org Cc: Qiang Liu , Vikram Garhwal , Francisco Iglesias , Pavel Pisa , Jason Wang Subject: [PATCH] hw/net/can/xlnx-zynqmp-can: fix assertion failures in transfer_fifo() Date: Mon, 9 Jan 2023 17:19:50 +0800 Message-Id: <20230109091950.784235-1-cyruscyliu@gmail.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Host-Lookup-Failed: Reverse DNS lookup failed for 183.159.98.38 (failed) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: softfail client-ip=183.159.98.38; envelope-from=cyruscyliu@gmail.com; helo=liuqiang-OptiPlex-7060 X-Spam_score_int: 48 X-Spam_score: 4.8 X-Spam_bar: ++++ X-Spam_report: (4.8 / 5.0 requ) BAYES_00=-1.9, DKIM_ADSP_CUSTOM_MED=0.001, FORGED_GMAIL_RCVD=1, FREEMAIL_FROM=0.001, FSL_HELO_NON_FQDN_1=0.001, HELO_NO_DOMAIN=0.001, NML_ADSP_CUSTOM_MED=0.9, RCVD_IN_PBL=3.335, RDNS_NONE=0.793, SPF_SOFTFAIL=0.665, SPOOFED_FREEMAIL=0.001, SPOOFED_FREEMAIL_NO_RDNS=0.001, SPOOF_GMAIL_MID=0.001, UNPARSEABLE_RELAY=0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1673259640014100003 Content-Type: text/plain; charset="utf-8" Check fifos before poping data from and pushing data into it. Fixes: 98e5d7a2b726 ("hw/net/can: Introduce Xilinx ZynqMP CAN controller") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1425 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1427 Reported-by: Qiang Liu Signed-off-by: Qiang Liu --- hw/net/can/xlnx-zynqmp-can.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/hw/net/can/xlnx-zynqmp-can.c b/hw/net/can/xlnx-zynqmp-can.c index e93e6c5e19..55d3221b49 100644 --- a/hw/net/can/xlnx-zynqmp-can.c +++ b/hw/net/can/xlnx-zynqmp-can.c @@ -451,6 +451,12 @@ static void transfer_fifo(XlnxZynqMPCANState *s, Fifo3= 2 *fifo) } =20 while (!fifo32_is_empty(fifo)) { + if (fifo32_num_used(fifo) < (4 * CAN_FRAME_SIZE)) { + g_autofree char *path =3D object_get_canonical_path(OBJECT(s)); + qemu_log_mask(LOG_GUEST_ERROR, "%s: data left in the fifo is n= ot" + " enough for transfer.\n", path); + break; + } for (i =3D 0; i < CAN_FRAME_SIZE; i++) { data[i] =3D fifo32_pop(fifo); } @@ -463,7 +469,8 @@ static void transfer_fifo(XlnxZynqMPCANState *s, Fifo32= *fifo) * acknowledged. The XlnxZynqMPCAN core receives any message * that it transmits. */ - if (fifo32_is_full(&s->rx_fifo)) { + if (fifo32_is_full(&s->rx_fifo) || + (fifo32_num_free(&s->rx_fifo) < (4 * CAN_FRAME_SIZE)))= { ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOFL= W, 1); } else { for (i =3D 0; i < CAN_FRAME_SIZE; i++) { --=20 2.25.1