mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rtl8139: limit transmission buffer size in c+ mode

Browse Source 
The tx buffer would be re-allocated for tx descriptor with big size
and without LS bit set, this would make guest driver could easily let
qemu to allocate unlimited.

In linux host, a glib failure were easy to be triggered:

GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes

This patch fix this by adding a limit. As the spec didn't tell the maximum size
of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536).

Changes from V1:

Drop the while statement and s->cplus_txbuffer check.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Jason Wang 2012-03-07 11:17:48 +08:00 committed by Michael S. Tsirkin
parent 453058d3e7
commit cde31a0e3d
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hw/rtl8139.c
View File

@ -2061,13 +2061,12 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
s->cplus_txbuffer_len);
}
while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
if (s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
{
s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE;
s->cplus_txbuffer = g_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len);
DPRINTF("+++ C+ mode transmission buffer space changed to %d\n",
s->cplus_txbuffer_len);
/* The spec didn't tell the maximum size, stick to CP_TX_BUFFER_SIZE */
txsize = s->cplus_txbuffer_len - s->cplus_txbuffer_offset;
DPRINTF("+++ C+ mode transmission buffer overrun, truncated descriptor"
"length to %d\n", txsize);
}
if (!s->cplus_txbuffer)