| Message ID | 20200426105539.GA12684@ls3530.fritz.box (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] Fix tulip breakage | expand |
On 2020/4/26 下午6:55, Helge Deller wrote: > The tulip network driver in a qemu-system-hppa emulation is broken in > the sense that bigger network packages aren't received any longer and > thus even running e.g. "apt update" inside the VM fails. > > The breakage was introduced by commit 8ffb7265af ("check frame size and > r/w data length") which added checks to prevent accesses outside of the > rx/tx buffers. > > But the new checks were implemented wrong. The variable rx_frame_len > counts backwards, from rx_frame_size down to zero, and the variable len > is never bigger than rx_frame_len, so accesses just can't happen and the > checks are unnecessary. > On the contrary the checks now prevented bigger packages to be moved > into the rx buffers. > > This patch reverts the wrong checks and were sucessfully tested with a > qemu-system-hppa emulation. > > Fixes: 8ffb7265af ("check frame size and r/w data length") > Buglink: https://bugs.launchpad.net/bugs/1874539 > Signed-off-by: Helge Deller <deller@gmx.de> > > --- > changes v2 to v1: > - renamed patch title > - rephrased commit message > - no changes to patch itself > > diff --git a/hw/net/tulip.c b/hw/net/tulip.c > index 1295f51d07..59d21defcc 100644 > --- a/hw/net/tulip.c > +++ b/hw/net/tulip.c > @@ -171,9 +171,6 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc) > len = s->rx_frame_len; > } > > - if (s->rx_frame_len + len > sizeof(s->rx_frame)) { > - return; > - } > pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame + > (s->rx_frame_size - s->rx_frame_len), len); > s->rx_frame_len -= len; > @@ -186,9 +183,6 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc) > len = s->rx_frame_len; > } > > - if (s->rx_frame_len + len > sizeof(s->rx_frame)) { > - return; > - } > pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame + > (s->rx_frame_size - s->rx_frame_len), len); > s->rx_frame_len -= len; Queued for 5.1 and stable. Thanks
diff --git a/hw/net/tulip.c b/hw/net/tulip.c index 1295f51d07..59d21defcc 100644 --- a/hw/net/tulip.c +++ b/hw/net/tulip.c @@ -171,9 +171,6 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc) len = s->rx_frame_len; } - if (s->rx_frame_len + len > sizeof(s->rx_frame)) { - return; - } pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame + (s->rx_frame_size - s->rx_frame_len), len); s->rx_frame_len -= len; @@ -186,9 +183,6 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc) len = s->rx_frame_len; } - if (s->rx_frame_len + len > sizeof(s->rx_frame)) { - return; - } pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame + (s->rx_frame_size - s->rx_frame_len), len); s->rx_frame_len -= len;
The tulip network driver in a qemu-system-hppa emulation is broken in the sense that bigger network packages aren't received any longer and thus even running e.g. "apt update" inside the VM fails. The breakage was introduced by commit 8ffb7265af ("check frame size and r/w data length") which added checks to prevent accesses outside of the rx/tx buffers. But the new checks were implemented wrong. The variable rx_frame_len counts backwards, from rx_frame_size down to zero, and the variable len is never bigger than rx_frame_len, so accesses just can't happen and the checks are unnecessary. On the contrary the checks now prevented bigger packages to be moved into the rx buffers. This patch reverts the wrong checks and were sucessfully tested with a qemu-system-hppa emulation. Fixes: 8ffb7265af ("check frame size and r/w data length") Buglink: https://bugs.launchpad.net/bugs/1874539 Signed-off-by: Helge Deller <deller@gmx.de> --- changes v2 to v1: - renamed patch title - rephrased commit message - no changes to patch itself