From nobody Wed Apr 16 17:09:14 2025
Delivered-To: importer@patchew.org
Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as
permitted sender) client-ip=208.118.235.17;
envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org;
helo=lists.gnu.org;
Authentication-Results: mx.zoho.com;
spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted
sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org;
Return-Path: <qemu-devel-bounces+importer=patchew.org@nongnu.org>
Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by
mx.zohomail.com
with SMTPS id 1487131477558452.8274137810571;
Tue, 14 Feb 2017 20:04:37 -0800 (PST)
Received: from localhost ([::1]:38391 helo=lists.gnu.org)
by lists.gnu.org with esmtp (Exim 4.71)
(envelope-from <qemu-devel-bounces+importer=patchew.org@nongnu.org>)
id 1cdqpY-00022M-E5
for importer@patchew.org; Tue, 14 Feb 2017 23:04:36 -0500
Received: from eggs.gnu.org ([2001:4830:134:3::10]:48830)
by lists.gnu.org with esmtp (Exim 4.71)
(envelope-from <jasowang@redhat.com>) id 1cdqex-00028t-5D
for qemu-devel@nongnu.org; Tue, 14 Feb 2017 22:53:43 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
(envelope-from <jasowang@redhat.com>) id 1cdqev-0008R3-Po
for qemu-devel@nongnu.org; Tue, 14 Feb 2017 22:53:39 -0500
Received: from mx1.redhat.com ([209.132.183.28]:34106)
by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
(Exim 4.71) (envelope-from <jasowang@redhat.com>) id 1cdqev-0008Qk-K2
for qemu-devel@nongnu.org; Tue, 14 Feb 2017 22:53:37 -0500
Received: from int-mx09.intmail.prod.int.phx2.redhat.com
(int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.redhat.com (Postfix) with ESMTPS id B7AF7D1FD3;
Wed, 15 Feb 2017 03:53:37 +0000 (UTC)
Received: from jason-ThinkPad-T450s.redhat.com (vpn1-4-152.pek2.redhat.com
[10.72.4.152])
by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP
id v1F3rP5p027443; Tue, 14 Feb 2017 22:53:35 -0500
From: Jason Wang <jasowang@redhat.com>
To: peter.maydell@linaro.org
Date: Wed, 15 Feb 2017 11:53:21 +0800
Message-Id: <1487130802-27953-5-git-send-email-jasowang@redhat.com>
In-Reply-To: <1487130802-27953-1-git-send-email-jasowang@redhat.com>
References: <1487130802-27953-1-git-send-email-jasowang@redhat.com>
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16
(mx1.redhat.com [10.5.110.27]);
Wed, 15 Feb 2017 03:53:37 +0000 (UTC)
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
[fuzzy]
X-Received-From: 209.132.183.28
Subject: [Qemu-devel] [PULL 4/5] net: imx: limit buffer descriptor count
X-BeenThere: qemu-devel@nongnu.org
X-Mailman-Version: 2.1.21
Precedence: list
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Cc: Jason Wang <jasowang@redhat.com>, qemu-devel@nongnu.org,
Prasad J Pandit <pjp@fedoraproject.org>
Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org
Sender: "Qemu-devel" <qemu-devel-bounces+importer=patchew.org@nongnu.org>
X-ZohoMail: RSF_0 Z_629925259 SPT_0
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
From: Prasad J Pandit <pjp@fedoraproject.org>
i.MX Fast Ethernet Controller uses buffer descriptors to manage
data flow to/fro receive & transmit queues. While transmitting
packets, it could continue to read buffer descriptors if a buffer
descriptor has length of zero and has crafted values in bd.flags.
Set an upper limit to number of buffer descriptors.
Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
hw/net/imx_fec.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index 50c7564..90e6ee3 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -55,6 +55,8 @@
} \
} while (0)
=20
+#define IMX_MAX_DESC 1024
+
static const char *imx_default_reg_name(IMXFECState *s, uint32_t index)
{
static char tmp[20];
@@ -402,12 +404,12 @@ static void imx_eth_update(IMXFECState *s)
=20
static void imx_fec_do_tx(IMXFECState *s)
{
- int frame_size =3D 0;
+ int frame_size =3D 0, descnt =3D 0;
uint8_t frame[ENET_MAX_FRAME_SIZE];
uint8_t *ptr =3D frame;
uint32_t addr =3D s->tx_descriptor;
=20
- while (1) {
+ while (descnt++ < IMX_MAX_DESC) {
IMXFECBufDesc bd;
int len;
=20
@@ -453,12 +455,12 @@ static void imx_fec_do_tx(IMXFECState *s)
=20
static void imx_enet_do_tx(IMXFECState *s)
{
- int frame_size =3D 0;
+ int frame_size =3D 0, descnt =3D 0;
uint8_t frame[ENET_MAX_FRAME_SIZE];
uint8_t *ptr =3D frame;
uint32_t addr =3D s->tx_descriptor;
=20
- while (1) {
+ while (descnt++ < IMX_MAX_DESC) {
IMXENETBufDesc bd;
int len;
=20
--=20
2.7.4