diff options
| author | Jason Wang <jasowang@redhat.com> | 2012-03-07 11:17:48 +0800 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2012-03-16 01:04:50 +0200 |
| commit | cde31a0e3dc0e4ac83e454d6096350cec584adf1 (patch) | |
| tree | 002b3822ae5914e645aa0ab60d24af1c76e6f6e5 | |
| parent | 453058d3e7111632b795c85f7d3bb36df25d5beb (diff) | |
rtl8139: limit transmission buffer size in c+ mode
The tx buffer would be re-allocated for tx descriptor with big size
and without LS bit set, this would make guest driver could easily let
qemu to allocate unlimited.
In linux host, a glib failure were easy to be triggered:
GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes
This patch fix this by adding a limit. As the spec didn't tell the maximum size
of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536).
Changes from V1:
Drop the while statement and s->cplus_txbuffer check.
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
| -rw-r--r-- | hw/rtl8139.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/hw/rtl8139.c b/hw/rtl8139.c index 05b8e1e3d7..be4bc6a947 100644 --- a/hw/rtl8139.c +++ b/hw/rtl8139.c @@ -2061,13 +2061,12 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) s->cplus_txbuffer_len); } - while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len) + if (s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len) { - s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE; - s->cplus_txbuffer = g_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len); - - DPRINTF("+++ C+ mode transmission buffer space changed to %d\n", - s->cplus_txbuffer_len); + /* The spec didn't tell the maximum size, stick to CP_TX_BUFFER_SIZE */ + txsize = s->cplus_txbuffer_len - s->cplus_txbuffer_offset; + DPRINTF("+++ C+ mode transmission buffer overrun, truncated descriptor" + "length to %d\n", txsize); } if (!s->cplus_txbuffer) |