On 23/10/26 17:31, Peter Maydell wrote:
The Cadence GEM allows the guest to program "screening registers"
which control which queue received network data should be sent to.
The field for the queue number in these registers is 4 bits, but the
device might not actually have that many queues. We weren't checking
this, which meant the guest could program a value that caused us to
index off the end of various arrays.
Check against num_priority_queues, and treat out-of-range values
as if the screen didn't match (i.e. go to queue 0). (This is a
best guess at reasonable behaviour since I don't have access to
a datasheet for this device.)
Cc: [email protected]
Fixes: e8e4994313b7 ("cadence_gem: Add support for screening")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4363
Signed-off-by: Peter Maydell <[email protected]>
---
hw/net/cadence_gem.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
