[STABLE] Musicpal: Fix descriptor walk in eth_send

Submitted by Jan Kiszka on Jan. 24, 2010, 8:51 a.m.

Details

Message ID 4B5C0A25.40202@web.de
State New
Headers show

Commit Message

Jan Kiszka Jan. 24, 2010, 8:51 a.m.
Commit 930c86820e introduced a regression to eth_send: eth_tx_desc_put
manipulates the host's tx descriptor copy before writing it back, but
two lines down the descriptor is evaluated again, leaving us with an
invalid next address if host and guest endianness differ. So this was
the actual issue commit 2e87c5b937 tried to paper over.

Signed-off-by: Jan Kiszka <jan.kiszka@web.de>
---
 hw/musicpal.c |    7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)

Comments

malc Jan. 24, 2010, 1:59 p.m.
On Sun, 24 Jan 2010, Jan Kiszka wrote:

> Commit 930c86820e introduced a regression to eth_send: eth_tx_desc_put
> manipulates the host's tx descriptor copy before writing it back, but
> two lines down the descriptor is evaluated again, leaving us with an
> invalid next address if host and guest endianness differ. So this was
> the actual issue commit 2e87c5b937 tried to paper over.

Applied to master.

[..snip..]
Anthony Liguori Jan. 26, 2010, 10:21 p.m.
On 01/24/2010 02:51 AM, Jan Kiszka wrote:
> Commit 930c86820e introduced a regression to eth_send: eth_tx_desc_put
> manipulates the host's tx descriptor copy before writing it back, but
> two lines down the descriptor is evaluated again, leaving us with an
> invalid next address if host and guest endianness differ. So this was
> the actual issue commit 2e87c5b937 tried to paper over.
>
> Signed-off-by: Jan Kiszka<jan.kiszka@web.de>
>    
Applied to stable.  Thanks.

Regards,

Anthony Liguori
> ---
>   hw/musicpal.c |    7 +++----
>   1 files changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/hw/musicpal.c b/hw/musicpal.c
> index e424a7d..b8af15e 100644
> --- a/hw/musicpal.c
> +++ b/hw/musicpal.c
> @@ -238,14 +238,13 @@ static void eth_send(mv88w8618_eth_state *s, int queue_index)
>   {
>       uint32_t desc_addr = s->tx_queue[queue_index];
>       mv88w8618_tx_desc desc;
> +    uint32_t next_desc;
>       uint8_t buf[2048];
>       int len;
>
> -    if (!desc_addr) {
> -        return;
> -    }
>       do {
>           eth_tx_desc_get(desc_addr,&desc);
> +        next_desc = desc.next;
>           if (desc.cmdstat&  MP_ETH_TX_OWN) {
>               len = desc.bytes;
>               if (len<  2048) {
> @@ -256,7 +255,7 @@ static void eth_send(mv88w8618_eth_state *s, int queue_index)
>               s->icr |= 1<<  (MP_ETH_IRQ_TXLO_BIT - queue_index);
>               eth_tx_desc_put(desc_addr,&desc);
>           }
> -        desc_addr = desc.next;
> +        desc_addr = next_desc;
>       } while (desc_addr != s->tx_queue[queue_index]);
>   }
>
>

Patch hide | download patch | download mbox

diff --git a/hw/musicpal.c b/hw/musicpal.c
index e424a7d..b8af15e 100644
--- a/hw/musicpal.c
+++ b/hw/musicpal.c
@@ -238,14 +238,13 @@  static void eth_send(mv88w8618_eth_state *s, int queue_index)
 {
     uint32_t desc_addr = s->tx_queue[queue_index];
     mv88w8618_tx_desc desc;
+    uint32_t next_desc;
     uint8_t buf[2048];
     int len;
 
-    if (!desc_addr) {
-        return;
-    }
     do {
         eth_tx_desc_get(desc_addr, &desc);
+        next_desc = desc.next;
         if (desc.cmdstat & MP_ETH_TX_OWN) {
             len = desc.bytes;
             if (len < 2048) {
@@ -256,7 +255,7 @@  static void eth_send(mv88w8618_eth_state *s, int queue_index)
             s->icr |= 1 << (MP_ETH_IRQ_TXLO_BIT - queue_index);
             eth_tx_desc_put(desc_addr, &desc);
         }
-        desc_addr = desc.next;
+        desc_addr = next_desc;
     } while (desc_addr != s->tx_queue[queue_index]);
 }