mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 01:43:39 +00:00
hw/net/e1000e: advance desc_offset in case of null descriptor
While receiving packets via e1000e_write_packet_to_guest() routine, 'desc_offset' is advanced only when RX descriptor is processed. And RX descriptor is not processed if it has NULL buffer address. This may lead to an infinite loop condition. Increament 'desc_offset' to process next descriptor in the ring to avoid infinite loop. Reported-by: Cheol-woo Myung <330cjfdn@gmail.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
This commit is contained in:
parent
23895cbd82
commit
c2cb511634
|
@ -1596,13 +1596,13 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
|
|||
(const char *) &fcs_pad, e1000x_fcs_len(core->mac));
|
||||
}
|
||||
}
|
||||
desc_offset += desc_size;
|
||||
if (desc_offset >= total_size) {
|
||||
is_last = true;
|
||||
}
|
||||
} else { /* as per intel docs; skip descriptors with null buf addr */
|
||||
trace_e1000e_rx_null_descriptor();
|
||||
}
|
||||
desc_offset += desc_size;
|
||||
if (desc_offset >= total_size) {
|
||||
is_last = true;
|
||||
}
|
||||
|
||||
e1000e_write_rx_descr(core, desc, is_last ? core->rx_pkt : NULL,
|
||||
rss_info, do_ps ? ps_hdr_len : 0, &bastate.written);
|
||||
|
|
Loading…
Reference in a new issue