[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 2/3] net: vmxnet3: check for device_active before wri
From: |
Jason Wang |
Subject: |
[Qemu-devel] [PULL 2/3] net: vmxnet3: check for device_active before write |
Date: |
Tue, 9 Aug 2016 15:34:32 +0800 |
From: Li Qiang <address@hidden>
Vmxnet3 device emulator does not check if the device is active,
before using it for write. It leads to a use after free issue,
if the vmxnet3_io_bar0_write routine is called after the device is
deactivated. Add check to avoid it.
Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Acked-by: Dmitry Fleytman <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
---
hw/net/vmxnet3.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index bbf44ad..90f6943 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -1167,6 +1167,10 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr,
{
VMXNET3State *s = opaque;
+ if (!s->device_active) {
+ return;
+ }
+
if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_TXPROD,
VMXNET3_DEVICE_MAX_TX_QUEUES, VMXNET3_REG_ALIGN)) {
int tx_queue_idx =
--
2.7.4