]> xenbits.xensource.com Git - qemu-xen.git/commit
hw/net/msf2-emac: Don't modify descriptor in-place in emac_store_desc()
authorPeter Maydell <peter.maydell@linaro.org>
Mon, 24 Apr 2023 15:19:19 +0000 (16:19 +0100)
committerMichael Tokarev <mjt@tls.msk.ru>
Thu, 18 May 2023 18:09:59 +0000 (21:09 +0300)
commite96dc26e89e4eefa73088b0358cc389607a4cbc9
treebac612476deff98085dac534f4650c231bc6aa25
parent32900bff7025d7141380a7c6ff17a5b2c26378fe
hw/net/msf2-emac: Don't modify descriptor in-place in emac_store_desc()

The msf2-emac ethernet controller has functions emac_load_desc() and
emac_store_desc() which read and write the in-memory descriptor
blocks and handle conversion between guest and host endianness.

As currently written, emac_store_desc() does the endianness
conversion in-place; this means that it effectively consumes the
input EmacDesc struct, because on a big-endian host the fields will
be overwritten with the little-endian versions of their values.
Unfortunately, in all the callsites the code continues to access
fields in the EmacDesc struct after it has called emac_store_desc()
-- specifically, it looks at the d.next field.

The effect of this is that on a big-endian host networking doesn't
work because the address of the next descriptor is corrupted.

We could fix this by making the callsite avoid using the struct; but
it's more robust to have emac_store_desc() leave its input alone.

(emac_load_desc() also does an in-place conversion, but here this is
fine, because the function is supposed to be initializing the
struct.)

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20230424151919.1333299-1-peter.maydell@linaro.org
(cherry picked from commit d565f58b38424e9a390a7ea33ff7477bab693fda)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
hw/net/msf2-emac.c