diff options
| author | Peter Maydell | 2015-11-27 11:44:42 +0100 |
|---|---|---|
| committer | Peter Maydell | 2015-11-27 11:44:42 +0100 |
| commit | 714487515dbe0c65d5904251e796cd3a5b3579fb (patch) | |
| tree | 2a1fbe4264ff8022814af20a6924eb32beaa7746 /hw/net/eepro100.c | |
| parent | Update version for v2.5.0-rc2 release (diff) | |
| parent | tap-win32: disable broken async write path (diff) | |
| download | qemu-714487515dbe0c65d5904251e796cd3a5b3579fb.tar.gz qemu-714487515dbe0c65d5904251e796cd3a5b3579fb.tar.xz qemu-714487515dbe0c65d5904251e796cd3a5b3579fb.zip | |
Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into staging
# gpg: Signature made Fri 27 Nov 2015 02:42:02 GMT using RSA key ID 398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg: It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F 3562 EF04 965B 398D 6211
* remotes/jasowang/tags/net-pull-request:
tap-win32: disable broken async write path
tap-win32: skip unexpected nodes during registry enumeration
eepro100: Prevent two endless loops
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/net/eepro100.c')
| -rw-r--r-- | hw/net/eepro100.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c index 60333b7fcc..685a4781b9 100644 --- a/hw/net/eepro100.c +++ b/hw/net/eepro100.c @@ -774,6 +774,11 @@ static void tx_command(EEPRO100State *s) #if 0 uint16_t tx_buffer_el = lduw_le_pci_dma(&s->dev, tbd_address + 6); #endif + if (tx_buffer_size == 0) { + /* Prevent an endless loop. */ + logout("loop in %s:%u\n", __FILE__, __LINE__); + break; + } tbd_address += 8; TRACE(RXTX, logout ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n", @@ -855,6 +860,10 @@ static void set_multicast_list(EEPRO100State *s) static void action_command(EEPRO100State *s) { + /* The loop below won't stop if it gets special handcrafted data. + Therefore we limit the number of iterations. */ + unsigned max_loop_count = 16; + for (;;) { bool bit_el; bool bit_s; @@ -870,6 +879,13 @@ static void action_command(EEPRO100State *s) #if 0 bool bit_sf = ((s->tx.command & COMMAND_SF) != 0); #endif + + if (max_loop_count-- == 0) { + /* Prevent an endless loop. */ + logout("loop in %s:%u\n", __FILE__, __LINE__); + break; + } + s->cu_offset = s->tx.link; TRACE(OTHER, logout("val=(cu start), status=0x%04x, command=0x%04x, link=0x%08x\n", |