rtl8139-bound-chaining

来自「xen 3.2.2 源码」· 代码 · 共 37 行

# HG changeset patch
# User [e-mail]
# Node ID 075f4ffdbbce5527ba525a515abe320703d17a0e
# Parent  51edd3c6a4d861db6ce1c9a02251ed49213c3002
[QEMU] rtl8139: Disallow chaining above 64K

As it stands the 8139C+ TX chaining is only bounded by realloc failure.
This is contrary to how the real hardware operates.  It also has DoS
potential when ioemu runs in dom0.

This patch makes any attempt to chain a frame beyond 64K fail
immediately.

Signed-off-by: Herbert Xu <[e-mail]>

Index: ioemu/hw/rtl8139.c
===================================================================
--- ioemu.orig/hw/rtl8139.c	2007-05-03 20:36:50.000000000 +0100
+++ ioemu/hw/rtl8139.c	2007-05-03 20:39:45.000000000 +0100
@@ -1999,12 +1999,12 @@
         DEBUG_PRINT(("RTL8139: +++ C+ mode transmission buffer allocated space %d\n", s->cplus_txbuffer_len));
     }
 
-    while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
+    if (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
     {
-        s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE;
-        s->cplus_txbuffer = realloc(s->cplus_txbuffer, s->cplus_txbuffer_len);
+	free(s->cplus_txbuffer);
+	s->cplus_txbuffer = NULL;
 
-        DEBUG_PRINT(("RTL8139: +++ C+ mode transmission buffer space changed to %d\n", s->cplus_txbuffer_len));
+	DEBUG_PRINT(("RTL8139: +++ C+ mode transmission buffer space exceeded: %d\n", s->cplus_txbuffer_offset + txsize));
     }
 
     if (!s->cplus_txbuffer)