On 2016年06月07日 13:02, P J P wrote:
+-- On Fri, 3 Jun 2016, P J P wrote --+ | +-- On Thu, 2 Jun 2016, Peter Maydell wrote --+ | | > case MIPSNET_TX_DATA_COUNT: | | > - s->tx_count = (val <= MAX_ETH_FRAME_SIZE) ? val : 0; | | > + s->tx_count = (val < MAX_ETH_FRAME_SIZE) ? val : MAX_ETH_FRAME_SIZE; | | > s->tx_written = 0; | | | | This is a behaviour change -- the register will now read | | back as MAX_ETH_FRAME_SIZE rather than 0 if written with | | an overlarge value. | | IIUC, 's->tx_count' indicates expected packet data length to be processed. | Maybe if this value was zero, packet was not to be sent; not sure. | | | Do we have any documentation on how this (simulated) | | device is supposed to behave in this case? @Jason: @Leon: ping...! -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
I could not find its docs, and the driver were even removed from linux kernel since it was no longer supported.
We need to fix this issue, but instead of changing the behavior, is it better the add a check in MIPSNET_TX_DATA_BUFFER?
Thanks
