From patchwork Mon Mar 5 03:08:24 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 144580 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 0BD7AB6F98 for ; Mon, 5 Mar 2012 14:43:41 +1100 (EST) Received: from localhost ([::1]:43653 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S4Opm-0002Ko-9y for incoming@patchwork.ozlabs.org; Sun, 04 Mar 2012 22:43:38 -0500 Received: from eggs.gnu.org ([208.118.235.92]:45407) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S4OI1-0007bv-If for qemu-devel@nongnu.org; Sun, 04 Mar 2012 22:08:46 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1S4OHz-0003uk-ST for qemu-devel@nongnu.org; Sun, 04 Mar 2012 22:08:45 -0500 Received: from mx1.redhat.com ([209.132.183.28]:13468) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S4OHz-0003rl-KK for qemu-devel@nongnu.org; Sun, 04 Mar 2012 22:08:43 -0500 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q2538S4l017380 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sun, 4 Mar 2012 22:08:28 -0500 Received: from [127.0.1.1] (dhcp-65-172.nay.redhat.com [10.66.65.172]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q2538Puq010642; Sun, 4 Mar 2012 22:08:26 -0500 To: aliguori@us.ibm.com, stefanha@linux.vnet.ibm.com, mst@redhat.com, qemu-devel@nongnu.org, benjamin.poirier@gmail.com, aurelien@aurel32.net From: Jason Wang Date: Mon, 05 Mar 2012 11:08:24 +0800 Message-ID: <20120305030824.8515.53602.stgit@jason-ThinkPad-T400> User-Agent: StGit/0.15 MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 209.132.183.28 X-Mailman-Approved-At: Sun, 04 Mar 2012 22:43:30 -0500 Subject: [Qemu-devel] [PATCH 1/6] rtl8139: limit transmission buffer size in c+ mode X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The tx buffer would be re-allocated for tx descriptor with big size and without LS bit set, this would make guest driver could easily let qemu to allocate unlimited. In linux host, a glib failure were easy to be triggered: GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes This patch fix this by adding a limit. As the spec didn't tell the maximum size of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536). Signed-off-by: Jason Wang --- hw/rtl8139.c | 9 ++++----- 1 files changed, 4 insertions(+), 5 deletions(-) diff --git a/hw/rtl8139.c b/hw/rtl8139.c index 05b8e1e..d9e742c 100644 --- a/hw/rtl8139.c +++ b/hw/rtl8139.c @@ -2063,11 +2063,10 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len) { - s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE; - s->cplus_txbuffer = g_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len); - - DPRINTF("+++ C+ mode transmission buffer space changed to %d\n", - s->cplus_txbuffer_len); + /* The spec didn't tell the maximum size, stick to CP_TX_BUFFER_SIZE */ + txsize = s->cplus_txbuffer_len - s->cplus_txbuffer_offset; + DPRINTF("+++ C+ mode transmission buffer overrun, truncated descriptor" + "length to %d\n", txsize); } if (!s->cplus_txbuffer)