| Message ID | 1448869103-16281-1-git-send-email-jasowang@redhat.com |
|---|---|
| State | New |
| Headers | show |
On Mon, Nov 30, 2015 at 03:38:22PM +0800, Jason Wang wrote: > From: Prasad J Pandit <pjp@fedoraproject.org> > > In loopback mode, pcnet_receive routine appends CRC code to the > receive buffer. If the data size given is same as the buffer size, > the appended CRC code overwrites 4 bytes after s->buffer. Added a > check to avoid that. > > Reported by: Qinghao Tang <luodalongde@gmail.com> > Cc: qemu-stable@nongnu.org > Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> > Signed-off-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> > --- > hw/net/pcnet.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c > index 0eb3cc4..309c40b 100644 > --- a/hw/net/pcnet.c > +++ b/hw/net/pcnet.c > @@ -1084,7 +1084,7 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) > uint32_t fcs = ~0; > uint8_t *p = src; > > - while (p != &src[size-4]) > + while (p != &src[size]) > CRC(fcs, *p++); > crc_err = (*(uint32_t *)p != htonl(fcs)); > } > @@ -1233,8 +1233,10 @@ static void pcnet_transmit(PCNetState *s) > bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT); > > /* if multi-tmd packet outsizes s->buffer then skip it silently. > - Note: this is not what real hw does */ > - if (s->xmit_pos + bcnt > sizeof(s->buffer)) { > + * Note: this is not what real hw does. > + * Last four bytes of s->buffer are used to store CRC FCS code. > + */ > + if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) { > s->xmit_pos = -1; > goto txdone; > } > -- > 2.5.0 >
On 11/30/2015 06:46 PM, Michael S. Tsirkin wrote: > On Mon, Nov 30, 2015 at 03:38:22PM +0800, Jason Wang wrote: >> From: Prasad J Pandit <pjp@fedoraproject.org> >> >> In loopback mode, pcnet_receive routine appends CRC code to the >> receive buffer. If the data size given is same as the buffer size, >> the appended CRC code overwrites 4 bytes after s->buffer. Added a >> check to avoid that. >> >> Reported by: Qinghao Tang <luodalongde@gmail.com> >> Cc: qemu-stable@nongnu.org >> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> >> Signed-off-by: Jason Wang <jasowang@redhat.com> > Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Applied to my -net. Thanks >> --- >> hw/net/pcnet.c | 8 +++++--- >> 1 file changed, 5 insertions(+), 3 deletions(-) >> >> diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c >> index 0eb3cc4..309c40b 100644 >> --- a/hw/net/pcnet.c >> +++ b/hw/net/pcnet.c >> @@ -1084,7 +1084,7 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) >> uint32_t fcs = ~0; >> uint8_t *p = src; >> >> - while (p != &src[size-4]) >> + while (p != &src[size]) >> CRC(fcs, *p++); >> crc_err = (*(uint32_t *)p != htonl(fcs)); >> } >> @@ -1233,8 +1233,10 @@ static void pcnet_transmit(PCNetState *s) >> bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT); >> >> /* if multi-tmd packet outsizes s->buffer then skip it silently. >> - Note: this is not what real hw does */ >> - if (s->xmit_pos + bcnt > sizeof(s->buffer)) { >> + * Note: this is not what real hw does. >> + * Last four bytes of s->buffer are used to store CRC FCS code. >> + */ >> + if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) { >> s->xmit_pos = -1; >> goto txdone; >> } >> -- >> 2.5.0 >>
diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c index 0eb3cc4..309c40b 100644 --- a/hw/net/pcnet.c +++ b/hw/net/pcnet.c @@ -1084,7 +1084,7 @@ ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) uint32_t fcs = ~0; uint8_t *p = src; - while (p != &src[size-4]) + while (p != &src[size]) CRC(fcs, *p++); crc_err = (*(uint32_t *)p != htonl(fcs)); } @@ -1233,8 +1233,10 @@ static void pcnet_transmit(PCNetState *s) bcnt = 4096 - GET_FIELD(tmd.length, TMDL, BCNT); /* if multi-tmd packet outsizes s->buffer then skip it silently. - Note: this is not what real hw does */ - if (s->xmit_pos + bcnt > sizeof(s->buffer)) { + * Note: this is not what real hw does. + * Last four bytes of s->buffer are used to store CRC FCS code. + */ + if (s->xmit_pos + bcnt > sizeof(s->buffer) - 4) { s->xmit_pos = -1; goto txdone; }