[Qemu-devel] [PULL for-2.3 0/1] Net patches

[Qemu-devel] [PULL for-2.3 0/1] Net patches

[Stefan Hajnoczi]

The following changes since commit 4ad9e2b36e1e00fe5b96c3448ecd673e11c4d6d8:

  Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20150326-1' into staging (2015-03-26 18:35:09 +0000)

are available in the git repository at:

  git://github.com/stefanha/qemu.git net-pull-request

for you to fetch changes up to 4e60a250d395ef0d04eb8b6489cc5f7615a8909b:

  hw/net/e1000: fix integer endianness (2015-03-27 10:23:50 +0000)

----------------------------------------------------------------

----------------------------------------------------------------

Shannon Zhao (1):
  hw/net/e1000: fix integer endianness

 hw/net/e1000.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.1.0

[Qemu-devel] [PULL for-2.3 1/1] hw/net/e1000: fix integer endianness

[Stefan Hajnoczi]

From: Shannon Zhao <zhaoshenglong@huawei.com>

It's detected by coverity.In is_vlan_packet s->mac_reg[VET] is
unsigned int but is dereferenced as a narrower unsigned short.
This may lead to unexpected results depending on machine
endianness.

Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Shannon Zhao <shannon.zhao@linaro.org>
Message-id: 1426224119-8352-1-git-send-email-zhaoshenglong@huawei.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/net/e1000.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index 3405cb9..091d61a 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -578,7 +578,7 @@ static inline int
 is_vlan_packet(E1000State *s, const uint8_t *buf)
 {
     return (be16_to_cpup((uint16_t *)(buf + 12)) ==
-                le16_to_cpup((uint16_t *)(s->mac_reg + VET)));
+                le16_to_cpu(s->mac_reg[VET]));
 }
 
 static inline int
@@ -711,7 +711,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
         (tp->cptse || txd_lower & E1000_TXD_CMD_EOP)) {
         tp->vlan_needed = 1;
         stw_be_p(tp->vlan_header,
-                      le16_to_cpup((uint16_t *)(s->mac_reg + VET)));
+                      le16_to_cpu(s->mac_reg[VET]));
         stw_be_p(tp->vlan_header + 2,
                       le16_to_cpu(dp->upper.fields.special));
     }
-- 
2.1.0