From af6d66e23557a36491a06857a447d016f6cf9f33 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= Date: Tue, 1 Sep 2020 14:21:50 +0200 Subject: [PATCH] ftgmac100: Check for invalid len and address before doing a DMA transfer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit According to the Aspeed specs, no interrupts are raised in that case but a "Tx-packets lost" status seems like a good modeling choice for all implementations. It is covered by the Linux kernel. Cc: Frederic Konrad Reviewed-by: Joel Stanley Message-Id: <20200819100956.2216690-14-clg@kaod.org> Signed-off-by: Cédric Le Goater --- hw/net/ftgmac100.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c index 014980d30a..280aa3d3a1 100644 --- a/hw/net/ftgmac100.c +++ b/hw/net/ftgmac100.c @@ -507,6 +507,15 @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring, } len = FTGMAC100_TXDES0_TXBUF_SIZE(bd.des0); + if (!len) { + /* + * 0 is an invalid size, however the HW does not raise any + * interrupt. Flag an error because the guest is buggy. + */ + qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid segment size\n", + __func__); + } + if (frame_size + len > sizeof(s->frame)) { qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n", __func__, len);