From 3ab62ac7e7403681568d33d150fa2496ffec9a94 Mon Sep 17 00:00:00 2001
Message-Id: <3ab62ac7e7403681568d33d150fa2496ffec9a94.1342714517.git.minovotn@redhat.com>
From: Amos Kong <akong@redhat.com>
Date: Thu, 19 Jul 2012 08:39:46 +0200
Subject: [PATCH] rtl8139: limit transmission buffer size in c+ mode

RH-Author: Amos Kong <akong@redhat.com>
Message-id: <1342687186-15389-1-git-send-email-akong@redhat.com>
Patchwork-id: 40375
O-Subject: [RHEL-5.9 KVM PATCH] rtl8139: limit transmission buffer size in c+ mode
Bugzilla: 781922
RH-Acked-by: Xiao Wang <jasowang@redhat.com>
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
RH-Acked-by: Alex Williamson <alex.williamson@redhat.com>

From: Jason Wang <jasowang@redhat.com>

Bugzilla: 781922
Brew: https://brewweb.devel.redhat.com/taskinfo?taskID=4620525
Test: tested in localhost, oom abort will occur in RHEL5

The tx buffer would be re-allocated for tx descriptor with big size
and without LS bit set, this would make guest driver could easily let
qemu to allocate unlimited.

In linux host, a glib failure were easy to be triggered:

GLib-ERROR **: gmem.c:176: failed to allocate 18446744071562067968 bytes

This patch fix this by adding a limit. As the spec didn't tell the maximum size
of buffer allowed, stick it to current CP_TX_BUFFER_SIZE (65536).

Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

(cherry-picked from commit cde31a0e3dc0e4ac83e454d6096350cec584adf1)

Signed-off-by: Amos Kong <akong@redhat.com>
---
 qemu/hw/rtl8139.c |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

Signed-off-by: Michal Novotny <minovotn@redhat.com>
---
 qemu/hw/rtl8139.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/qemu/hw/rtl8139.c b/qemu/hw/rtl8139.c
index df450a2..e552ac5 100644
--- a/qemu/hw/rtl8139.c
+++ b/qemu/hw/rtl8139.c
@@ -2005,13 +2005,13 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
         DEBUG_PRINT(("RTL8139: +++ C+ mode transmission buffer allocated space %d\n", s->cplus_txbuffer_len));
     }
 
-    while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
+    if (s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
     {
-        s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE;
-        s->cplus_txbuffer = qemu_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len);
-
-        DEBUG_PRINT(("RTL8139: +++ C+ mode transmission buffer space changed to %d\n", s->cplus_txbuffer_len));
-    }
+        /* The spec didn't tell the maximum size, stick to CP_TX_BUFFER_SIZE */
+        txsize = s->cplus_txbuffer_len - s->cplus_txbuffer_offset;
+        DEBUG_PRINT(("+++ C+ mode transmission buffer overrun, truncated "
+                     "descriptor length to %d\n", txsize));
+     }
 
     if (!s->cplus_txbuffer)
     {
-- 
1.7.10.4