Re: [PATCH-for-9.0 v2 02/11] hw/net/lan9118: Fix overflow in MIL TX FIFO

[Peter Maydell]

On Tue, 9 Apr 2024 at 14:38, Philippe Mathieu-Daudé <philmd@linaro.org> wrote:
>
> When the MAC Interface Layer (MIL) transmit FIFO is full,
> truncate the packet, and raise the Transmitter Error (TXE)
> flag.
>
> Broken since model introduction in commit 2a42499017
> ("LAN9118 emulation").
>
> When using the reproducer from
> https://gitlab.com/qemu-project/qemu/-/issues/2267 we get:
>
>   hw/net/lan9118.c:798:17: runtime error:
>   index 2048 out of bounds for type 'uint8_t[2048]' (aka 'unsigned 
> char[2048]')
>     #0 0x563ec9a057b1 in tx_fifo_push hw/net/lan9118.c:798:43
>     #1 0x563ec99fbb28 in lan9118_writel hw/net/lan9118.c:1042:9
>     #2 0x563ec99f2de2 in lan9118_16bit_mode_write hw/net/lan9118.c:1205:9
>     #3 0x563ecbf78013 in memory_region_write_accessor system/memory.c:497:5
>     #4 0x563ecbf776f5 in access_with_adjusted_size system/memory.c:573:18
>     #5 0x563ecbf75643 in memory_region_dispatch_write system/memory.c:1521:16
>     #6 0x563ecc01bade in flatview_write_continue_step system/physmem.c:2713:18
>     #7 0x563ecc01b374 in flatview_write_continue system/physmem.c:2743:19
>     #8 0x563ecbff1c9b in flatview_write system/physmem.c:2774:12
>     #9 0x563ecbff1768 in address_space_write system/physmem.c:2894:18
>     ...
>
> [*] LAN9118 DS00002266B.pdf, Table 5.3.3 "INTERRUPT STATUS REGISTER"
>
> Reported-by: Will Lester
> Reported-by: Chuhong Yuan <hslester96@gmail.com>
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2267
> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> ---

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM