| Message ID | 20120307031748.6355.500.stgit@jason-ThinkPad-T400 |
|---|---|
| State | New |
| Headers | show |
On Wed, Mar 07, 2012 at 11:17:48AM +0800, Jason Wang wrote: > The tx buffer would be re-allocated for tx descriptor with big size > and without LS bit set, this would make guest driver could easily let > qemu to allocate unlimited. > > In linux host, a glib failure were easy to be triggered: > > GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes > > This patch fix this by adding a limit. As the spec didn't tell the maximum size > of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536). > > Changes from V1: > > Drop the while statement and s->cplus_txbuffer check. > > Signed-off-by: Jason Wang <jasowang@redhat.com> > --- > hw/rtl8139.c | 11 +++++------ > 1 files changed, 5 insertions(+), 6 deletions(-) Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
On Wed, Mar 07, 2012 at 08:13:51AM +0000, Stefan Hajnoczi wrote: > On Wed, Mar 07, 2012 at 11:17:48AM +0800, Jason Wang wrote: > > The tx buffer would be re-allocated for tx descriptor with big size > > and without LS bit set, this would make guest driver could easily let > > qemu to allocate unlimited. > > > > In linux host, a glib failure were easy to be triggered: > > > > GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes > > > > This patch fix this by adding a limit. As the spec didn't tell the maximum size > > of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536). > > > > Changes from V1: > > > > Drop the while statement and s->cplus_txbuffer check. > > > > Signed-off-by: Jason Wang <jasowang@redhat.com> > > --- > > hw/rtl8139.c | 11 +++++------ > > 1 files changed, 5 insertions(+), 6 deletions(-) > > Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Applied, thanks everyone.
diff --git a/hw/rtl8139.c b/hw/rtl8139.c index 05b8e1e..be4bc6a 100644 --- a/hw/rtl8139.c +++ b/hw/rtl8139.c @@ -2061,13 +2061,12 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) s->cplus_txbuffer_len); } - while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len) + if (s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len) { - s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE; - s->cplus_txbuffer = g_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len); - - DPRINTF("+++ C+ mode transmission buffer space changed to %d\n", - s->cplus_txbuffer_len); + /* The spec didn't tell the maximum size, stick to CP_TX_BUFFER_SIZE */ + txsize = s->cplus_txbuffer_len - s->cplus_txbuffer_offset; + DPRINTF("+++ C+ mode transmission buffer overrun, truncated descriptor" + "length to %d\n", txsize); } if (!s->cplus_txbuffer)
The tx buffer would be re-allocated for tx descriptor with big size and without LS bit set, this would make guest driver could easily let qemu to allocate unlimited. In linux host, a glib failure were easy to be triggered: GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes This patch fix this by adding a limit. As the spec didn't tell the maximum size of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536). Changes from V1: Drop the while statement and s->cplus_txbuffer check. Signed-off-by: Jason Wang <jasowang@redhat.com> --- hw/rtl8139.c | 11 +++++------ 1 files changed, 5 insertions(+), 6 deletions(-)