Commit 969e50b61a28 ("net: Pad short frames to minimum size before
sending from SLiRP/TAP") tries to pad frames but try to recyle the
local array that is used for padding to tap thread. This patch fixes
this by recyling the original buffer.

Fixes: 969e50b61a28 ("net: Pad short frames to minimum size before sending from SLiRP/TAP")
Tested-by: Howard Spoelstra <hsp.cat7@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap-win32.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/tap-win32.c b/net/tap-win32.c
index d7c2a8759c..7a6f3d7384 100644
--- a/net/tap-win32.c
+++ b/net/tap-win32.c
@@ -686,7 +686,7 @@ static ssize_t tap_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 static void tap_win32_send(void *opaque)
 {
     TAPState *s = opaque;
-    uint8_t *buf;
+    uint8_t *buf, *orig_buf;
     int max_size = 4096;
     int size;
     uint8_t min_pkt[ETH_ZLEN];
@@ -694,6 +694,8 @@ static void tap_win32_send(void *opaque)
 
     size = tap_win32_read(s->handle, &buf, max_size);
     if (size > 0) {
+        orig_buf = buf;
+
         if (!s->nc.peer->do_not_pad) {
             if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
                 buf = min_pkt;
@@ -702,7 +704,7 @@ static void tap_win32_send(void *opaque)
         }
 
         qemu_send_packet(&s->nc, buf, size);
-        tap_win32_free_buffer(s->handle, buf);
+        tap_win32_free_buffer(s->handle, orig_buf);
     }
 }
 
-- 
2.24.3 (Apple Git-128)

On Mon, Mar 29, 2021 at 10:20 AM Jason Wang <jasowang@redhat.com> wrote:
>
> Commit 969e50b61a28 ("net: Pad short frames to minimum size before
> sending from SLiRP/TAP") tries to pad frames but try to recyle the
> local array that is used for padding to tap thread. This patch fixes
> this by recyling the original buffer.
>
> Fixes: 969e50b61a28 ("net: Pad short frames to minimum size before sending from SLiRP/TAP")
> Tested-by: Howard Spoelstra <hsp.cat7@gmail.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
>  net/tap-win32.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>

Reviewed-by: Bin Meng <bmeng.cn@gmail.com>

Tested booting U-Boot with QEMU ppce500 on Windows, without the patch,
QEMU crashes
Tested-by: Bin Meng <bmeng.cn@gmail.com>

在 2021/3/29 上午11:01, Bin Meng 写道:
> On Mon, Mar 29, 2021 at 10:20 AM Jason Wang <jasowang@redhat.com> wrote:
>> Commit 969e50b61a28 ("net: Pad short frames to minimum size before
>> sending from SLiRP/TAP") tries to pad frames but try to recyle the
>> local array that is used for padding to tap thread. This patch fixes
>> this by recyling the original buffer.
>>
>> Fixes: 969e50b61a28 ("net: Pad short frames to minimum size before sending from SLiRP/TAP")
>> Tested-by: Howard Spoelstra <hsp.cat7@gmail.com>
>> Signed-off-by: Jason Wang <jasowang@redhat.com>
>> ---
>>   net/tap-win32.c | 6 ++++--
>>   1 file changed, 4 insertions(+), 2 deletions(-)
>>
> Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
>
> Tested booting U-Boot with QEMU ppce500 on Windows, without the patch,
> QEMU crashes
> Tested-by: Bin Meng <bmeng.cn@gmail.com>
>

Applied.

Thanks