diff options
| author | Jason Wang <jasowang@redhat.com> | 2021-02-24 13:45:28 +0800 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2021-03-15 16:41:22 +0800 |
| commit | 3de46e6fc489c52c9431a8a832ad8170a7569bd8 (patch) | |
| tree | 9b35439beacc4ffb61753a02a6a83ef1c62d046c | |
| parent | e73b4317b7b7a9d67368387c2f4fbfba6c43e39f (diff) | |
| download | qemu-3de46e6fc489c52c9431a8a832ad8170a7569bd8.zip qemu-3de46e6fc489c52c9431a8a832ad8170a7569bd8.tar.gz qemu-3de46e6fc489c52c9431a8a832ad8170a7569bd8.tar.bz2 | |
e1000: fail early for evil descriptor
During procss_tx_desc(), driver can try to chain data descriptor with
legacy descriptor, when will lead underflow for the following
calculation in process_tx_desc() for bytes:
if (tp->size + bytes > msh)
bytes = msh - tp->size;
This will lead a infinite loop. So check and fail early if tp->size if
greater or equal to msh.
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de>
Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
| -rw-r--r-- | hw/net/e1000.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/net/e1000.c b/hw/net/e1000.c index d8da2f6..4345d86 100644 --- a/hw/net/e1000.c +++ b/hw/net/e1000.c @@ -670,6 +670,9 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) msh = tp->tso_props.hdr_len + tp->tso_props.mss; do { bytes = split_size; + if (tp->size >= msh) { + goto eop; + } if (tp->size + bytes > msh) bytes = msh - tp->size; @@ -695,6 +698,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) tp->size += split_size; } +eop: if (!(txd_lower & E1000_TXD_CMD_EOP)) return; if (!(tp->cptse && tp->size < tp->tso_props.hdr_len)) { |