diff options
| author | Dana Rubin <dana.rubin@ravellosystems.com> | 2015-08-18 12:45:55 +0300 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2015-10-12 13:19:29 +0800 |
| commit | a7278b36fcab9af469563bd7b9dadebe2ae25e48 (patch) | |
| tree | 72bd2dc6e6c9218fc4848682adf4bd1dc62b5994 /hw/net/vmxnet3.c | |
| parent | 5fdb4671b08e0d1631447e81348b2b50a6b85bf7 (diff) | |
| download | qemu-a7278b36fcab9af469563bd7b9dadebe2ae25e48.zip qemu-a7278b36fcab9af469563bd7b9dadebe2ae25e48.tar.gz qemu-a7278b36fcab9af469563bd7b9dadebe2ae25e48.tar.bz2 | |
net/vmxnet3: Refine l2 header validation
Validation of l2 header length assumed minimal packet size as
eth_header + 2 * vlan_header regardless of the actual protocol.
This caused crash for valid non-IP packets shorter than 22 bytes, as
'tx_pkt->packet_type' hasn't been assigned for such packets, and
'vmxnet3_on_tx_done_update_stats()' expects it to be properly set.
Refine header length validation in 'vmxnet_tx_pkt_parse_headers'.
Check its return value during packet processing flow.
As a side effect, in case IPv4 and IPv6 header validation failure,
corrupt packets will be dropped.
Signed-off-by: Dana Rubin <dana.rubin@ravellosystems.com>
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw/net/vmxnet3.c')
| -rw-r--r-- | hw/net/vmxnet3.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index 04159c8..48ced71 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -729,9 +729,7 @@ static void vmxnet3_process_tx_queue(VMXNET3State *s, int qidx) } if (txd.eop) { - if (!s->skip_current_tx_pkt) { - vmxnet_tx_pkt_parse(s->tx_pkt); - + if (!s->skip_current_tx_pkt && vmxnet_tx_pkt_parse(s->tx_pkt)) { if (s->needs_vlan) { vmxnet_tx_pkt_setup_vlan_header(s->tx_pkt, s->tci); } |