From ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05 Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Thu, 4 Aug 2016 13:00:14 +0530 Subject: [PATCH 1/3] net: check fragment length during fragmentation Network transport abstraction layer supports packet fragmentation. While fragmenting a packet, it checks for more fragments from packet length and current fragment length. It is susceptible to an infinite loop, if the current fragment length is zero. Add check to avoid it. Reported-by: Li Qiang Signed-off-by: Prasad J Pandit Reviewed-by: Dmitry Fleytman CC: qemu-stable@nongnu.org Signed-off-by: Jason Wang --- hw/net/net_tx_pkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c index efd43b47b8..53dfaa292c 100644 --- a/hw/net/net_tx_pkt.c +++ b/hw/net/net_tx_pkt.c @@ -590,7 +590,7 @@ static bool net_tx_pkt_do_sw_fragmentation(struct NetTxPkt *pkt, fragment_offset += fragment_len; - } while (more_frags); + } while (fragment_len && more_frags); return true; } From 6c352ca9b4ee3e1e286ea9e8434bd8e69ac7d0d8 Mon Sep 17 00:00:00 2001 From: Li Qiang Date: Mon, 8 Aug 2016 18:08:31 +0530 Subject: [PATCH 2/3] net: vmxnet3: check for device_active before write Vmxnet3 device emulator does not check if the device is active, before using it for write. It leads to a use after free issue, if the vmxnet3_io_bar0_write routine is called after the device is deactivated. Add check to avoid it. Reported-by: Li Qiang Signed-off-by: Prasad J Pandit Acked-by: Dmitry Fleytman Signed-off-by: Jason Wang --- hw/net/vmxnet3.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index bbf44adbcc..90f6943668 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1167,6 +1167,10 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr, { VMXNET3State *s = opaque; + if (!s->device_active) { + return; + } + if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_TXPROD, VMXNET3_DEVICE_MAX_TX_QUEUES, VMXNET3_REG_ALIGN)) { int tx_queue_idx = From a0d1cbdacff5df4ded16b753b38fdd9da6092968 Mon Sep 17 00:00:00 2001 From: chaojianhu Date: Tue, 9 Aug 2016 11:52:54 +0800 Subject: [PATCH 3/3] hw/net: Fix a heap overflow in xlnx.xps-ethernetlite The .receive callback of xlnx.xps-ethernetlite doesn't check the length of data before calling memcpy. As a result, the NetClientState object in heap will be overflowed. All versions of qemu with xlnx.xps-ethernetlite will be affected. Reported-by: chaojianhu Signed-off-by: chaojianhu Signed-off-by: Jason Wang --- hw/net/xilinx_ethlite.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c index 54db2b83bd..35de353b7c 100644 --- a/hw/net/xilinx_ethlite.c +++ b/hw/net/xilinx_ethlite.c @@ -197,6 +197,10 @@ static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size) } D(qemu_log("%s %zd rxbase=%x\n", __func__, size, rxbase)); + if (size > (R_MAX - R_RX_BUF0 - rxbase) * 4) { + D(qemu_log("ethlite packet is too big, size=%x\n", size)); + return -1; + } memcpy(&s->regs[rxbase + R_RX_BUF0], buf, size); s->regs[rxbase + R_RX_CTRL0] |= CTRL_S;