net/cadence_gem: Fix rx multi-fragment packets

Bytes_to_copy was being updated before its final use where it
advances the rx buffer pointer. This was causing total mayhem,
where packet data for any subsequent fragments was being fetched
from the wrong place.

Reported-by: Deepika Dhamija <[email protected]>
Signed-off-by: Peter Crosthwaite <[email protected]>
Reviewed-by: Peter Maydell <[email protected]>
Message-id: c2a1c65c1fd06eb274442a0fa4a6839d940e145e.1386136219[email protected]
Signed-off-by: Peter Maydell <[email protected]>

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 8cfad0401790c5df231211d3d61d00e25bfe9723..2afafdfb2b19e69b60d0a0f8be54ea595470a8b9 100644 (file)
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -733,8 +733,8 @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         /* Copy packet data to emulated DMA buffer */
         cpu_physical_memory_write(rx_desc_get_buffer(s->rx_desc) + rxbuf_offset,
                                   rxbuf_ptr, MIN(bytes_to_copy, rxbufsize));
-        bytes_to_copy -= MIN(bytes_to_copy, rxbufsize);
         rxbuf_ptr += MIN(bytes_to_copy, rxbufsize);
+        bytes_to_copy -= MIN(bytes_to_copy, rxbufsize);
 
         /* Update the descriptor.  */
         if (first_desc) {