Re: [Qemu-devel] [PATCH] net: mcf: check buffer descriptor length

2016-09-21 Thread P J P
Hello Paolo, +-- On Wed, 21 Sep 2016, Paolo Bonzini wrote --+ | Not exactly, because addr changes on every call to mcf_fec_read_bd. True, but the initial address 's->tx_descriptor' and 's->etdsr' could be set by user in imx_fec_write(). If bd.flags is set to FEC_BD_W, addr is reset to initi

Re: [Qemu-devel] [PATCH] net: mcf: check buffer descriptor length

2016-09-21 Thread Paolo Bonzini
On 21/09/2016 19:50, P J P wrote: > +-- On Wed, 21 Sep 2016, Paolo Bonzini wrote --+ > | On 21/09/2016 15:45, P J P wrote: > | > DPRINTF("tx_bd %x flags %04x len %d data %08x\n", > | > addr, bd.flags, bd.length, bd.data); > | > -if ((bd.flags & FEC_BD_R) == 0) {

Re: [Qemu-devel] [PATCH] net: mcf: check buffer descriptor length

2016-09-21 Thread P J P
+-- On Wed, 21 Sep 2016, Paolo Bonzini wrote --+ | On 21/09/2016 15:45, P J P wrote: | > DPRINTF("tx_bd %x flags %04x len %d data %08x\n", | > addr, bd.flags, bd.length, bd.data); | > -if ((bd.flags & FEC_BD_R) == 0) { | > +if (!bd.length || (bd.flags & FEC

Re: [Qemu-devel] [PATCH] net: mcf: check buffer descriptor length

2016-09-21 Thread Paolo Bonzini
On 21/09/2016 15:45, P J P wrote: > DPRINTF("tx_bd %x flags %04x len %d data %08x\n", > addr, bd.flags, bd.length, bd.data); > -if ((bd.flags & FEC_BD_R) == 0) { > +if (!bd.length || (bd.flags & FEC_BD_R) == 0) { > /* Run out of descriptors t

[Qemu-devel] [PATCH] net: mcf: check buffer descriptor length

2016-09-21 Thread P J P
From: Prasad J Pandit ColdFire Fast Ethernet Controller uses buffer descriptors to manage data flow to/fro receive & transmit queues. While transmitting packets, it could continue to read buffer descriptors if a buffer descriptor has length of zero. Add check to avoid it. Reported-by: Li Qiang