Re: [PATCH] net: tulip: check frame size and r/w data length

[Sven Schnelle <svens@stackframe.org>]

Hi,

thanks for your patch.

On Tue, Feb 11, 2020 at 01:09:30PM +0530, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> diff --git a/hw/net/tulip.c b/hw/net/tulip.c
> index cfac2719d3..aca2a3f17f 100644
> --- a/hw/net/tulip.c
> +++ b/hw/net/tulip.c
> @@ -164,27 +164,35 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
>      int len2 = (desc->control >> RDES1_BUF2_SIZE_SHIFT) & RDES1_BUF2_SIZE_MASK;
>      int len;
>  
> -    if (s->rx_frame_len && len1) {
> -        if (s->rx_frame_len > len1) {
> -            len = len1;
> -        } else {
> -            len = s->rx_frame_len;
> -        }
> -        pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
> -            (s->rx_frame_size - s->rx_frame_len), len);
> -        s->rx_frame_len -= len;
> +    if (!len1 || !len2 || !s->rx_frame_len) {
> +        return;

I haven't tested the patch yet, but would that work if the guest OS passes
only one buffer to the card? I.e. len1 = x, and len2 = 0 because only
buffer 1 is available?

Regards
Sven