On Mon, Sep 26, 2016 at 4:01 AM, Paolo Bonzini wrote:
>
>
> On 22/09/2016 19:22, Peter Maydell wrote:
>> +case GEM_RECEIVE_Q1_PTR ... GEM_RECEIVE_Q15_PTR:
>> +s->rx_desc_addr[offset - GEM_RECEIVE_Q1_PTR + 1] = val;
>> +break;
>
> MAX_PRIORITY_QUEUES is
On 22/09/2016 19:22, Peter Maydell wrote:
> +case GEM_RECEIVE_Q1_PTR ... GEM_RECEIVE_Q15_PTR:
> +s->rx_desc_addr[offset - GEM_RECEIVE_Q1_PTR + 1] = val;
> +break;
MAX_PRIORITY_QUEUES is still 8, so this can cause an out-of-bounds write
in s->rx_desc_addr (and likewise for
From: Alistair Francis
Signed-off-by: Alistair Francis
Reviewed-by: Peter Maydell
Message-id:
28921252217b1d14f16889bafa88675f5b7a66cb.1469727764.git.alistair.fran...@xilinx.com
Signed-off-by: Peter Maydell