diff options
| -rw-r--r-- | hw/e1000.c | 10 | ||||
| -rw-r--r-- | hw/vhost_net.c | 2 |
2 files changed, 11 insertions, 1 deletions
diff --git a/hw/e1000.c b/hw/e1000.c index 7d7d14002f..532efdc27d 100644 --- a/hw/e1000.c +++ b/hw/e1000.c @@ -55,6 +55,7 @@ static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL); #define IOPORT_SIZE 0x40 #define PNPMMIO_SIZE 0x20000 +#define MIN_BUF_SIZE 60 /* Min. octets in an ethernet frame sans FCS */ /* * HW models: @@ -635,10 +636,19 @@ e1000_receive(VLANClientState *nc, const uint8_t *buf, size_t size) uint32_t rdh_start; uint16_t vlan_special = 0; uint8_t vlan_status = 0, vlan_offset = 0; + uint8_t min_buf[MIN_BUF_SIZE]; if (!(s->mac_reg[RCTL] & E1000_RCTL_EN)) return -1; + /* Pad to minimum Ethernet frame length */ + if (size < sizeof(min_buf)) { + memcpy(min_buf, buf, size); + memset(&min_buf[size], 0, sizeof(min_buf) - size); + buf = min_buf; + size = sizeof(min_buf); + } + if (size > s->rxbuf_size) { DBGOUT(RX, "packet too large for buffers (%lu > %d)\n", (unsigned long)size, s->rxbuf_size); diff --git a/hw/vhost_net.c b/hw/vhost_net.c index 4a7b8194f2..c068be1f54 100644 --- a/hw/vhost_net.c +++ b/hw/vhost_net.c @@ -151,7 +151,7 @@ int vhost_net_start(struct vhost_net *net, return 0; fail: file.fd = -1; - while (--file.index >= 0) { + while (file.index-- > 0) { int r = ioctl(net->dev.control, VHOST_NET_SET_BACKEND, &file); assert(r >= 0); } |