Kernel: Be a little more defensive when indexing E1000 Rx/Tx buffers

2 files changed, 8 insertions, 7 deletions

diff --git a/Kernel/Net/E1000NetworkAdapter.cpp b/Kernel/Net/E1000NetworkAdapter.cpp
index 9c422246ee..84948bd4d4 100644
--- a/Kernel/Net/E1000NetworkAdapter.cpp
+++ b/Kernel/Net/E1000NetworkAdapter.cpp
@@ -277,7 +277,7 @@ bool E1000NetworkAdapter::link_up()
 void E1000NetworkAdapter::initialize_rx_descriptors()
 {
     auto* rx_descriptors = (e1000_tx_desc*)m_rx_descriptors_region->vaddr().as_ptr();
-    for (int i = 0; i < number_of_rx_descriptors; ++i) {
+    for (size_t i = 0; i < number_of_rx_descriptors; ++i) {
         auto& descriptor = rx_descriptors[i];
         auto region = MM.allocate_contiguous_kernel_region(8192, "E1000 RX buffer", Region::Access::Read | Region::Access::Write);
         ASSERT(region);
@@ -298,7 +298,7 @@ void E1000NetworkAdapter::initialize_rx_descriptors()
 void E1000NetworkAdapter::initialize_tx_descriptors()
 {
     auto* tx_descriptors = (e1000_tx_desc*)m_tx_descriptors_region->vaddr().as_ptr();
-    for (int i = 0; i < number_of_tx_descriptors; ++i) {
+    for (size_t i = 0; i < number_of_tx_descriptors; ++i) {
         auto& descriptor = tx_descriptors[i];
         auto region = MM.allocate_contiguous_kernel_region(8192, "E1000 TX buffer", Region::Access::Read | Region::Access::Write);
         ASSERT(region);
@@ -389,7 +389,7 @@ u32 E1000NetworkAdapter::in32(u16 address)
 void E1000NetworkAdapter::send_raw(const u8* data, size_t length)
 {
     disable_irq();
-    u32 tx_current = in32(REG_TXDESCTAIL);
+    size_t tx_current = in32(REG_TXDESCTAIL) % number_of_tx_descriptors;
 #ifdef E1000_DEBUG
     klog() << "E1000: Sending packet (" << length << " bytes)";
 #endif
@@ -425,14 +425,15 @@ void E1000NetworkAdapter::receive()
     auto* rx_descriptors = (e1000_tx_desc*)m_rx_descriptors_region->vaddr().as_ptr();
     u32 rx_current;
     for (;;) {
-        rx_current = in32(REG_RXDESCTAIL);
-        if (rx_current == in32(REG_RXDESCHEAD))
+        rx_current = in32(REG_RXDESCTAIL) % number_of_rx_descriptors;
+        if (rx_current == (in32(REG_RXDESCHEAD) % number_of_rx_descriptors))
             return;
         rx_current = (rx_current + 1) % number_of_rx_descriptors;
         if (!(rx_descriptors[rx_current].status & 1))
             break;
         auto* buffer = m_rx_buffers_regions[rx_current].vaddr().as_ptr();
         u16 length = rx_descriptors[rx_current].length;
+        ASSERT(length <= 8192);
 #ifdef E1000_DEBUG
         klog() << "E1000: Received 1 packet @ " << buffer << " (" << length << ") bytes!";
 #endif
diff --git a/Kernel/Net/E1000NetworkAdapter.h b/Kernel/Net/E1000NetworkAdapter.h
index 934f77e9cf..77b4de7931 100644
--- a/Kernel/Net/E1000NetworkAdapter.h
+++ b/Kernel/Net/E1000NetworkAdapter.h
@@ -104,8 +104,8 @@ private:
     bool m_has_eeprom { false };
     bool m_use_mmio { false };
 
-    static const int number_of_rx_descriptors = 32;
-    static const int number_of_tx_descriptors = 8;
+    static const size_t number_of_rx_descriptors = 32;
+    static const size_t number_of_tx_descriptors = 8;
 
     WaitQueue m_wait_queue;
 };