[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH v2] net: mipsnet: check transmit buffer size bef

From: Jason Wang
Subject: Re: [Qemu-devel] [PATCH v2] net: mipsnet: check transmit buffer size before sending
Date: Mon, 13 Jun 2016 11:01:58 +0800
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0

On 2016年06月08日 18:37, P J P wrote:
From: Prasad J Pandit <address@hidden>

When processing MIPSnet I/O port write operation, it uses a
transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices
's->tx_written' and 's->tx_count' are used to control data written
to this buffer. If the two were to be equal before writing, it'd
lead to an OOB write access beyond tx_buffer. Add check to avoid it.

Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
  hw/net/mipsnet.c | 8 +++++---
  1 file changed, 5 insertions(+), 3 deletions(-)

Update as per:
   -> https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg02089.html

diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index 740cd98..450e42d 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -180,10 +180,12 @@ static void mipsnet_ioport_write(void *opaque, hwaddr 
          s->tx_buffer[s->tx_written++] = val;

I believe we may still have a buffer overflow here, no?

-        if (s->tx_written == s->tx_count) {
+        if ((s->tx_written >= MAX_ETH_FRAME_SIZE)
+            || (s->tx_written == s->tx_count)) {
              /* Send buffer. */
-            trace_mipsnet_send(s->tx_count);
-            qemu_send_packet(qemu_get_queue(s->nic), s->tx_buffer, 
+            trace_mipsnet_send(s->tx_written);
+            qemu_send_packet(qemu_get_queue(s->nic),
+                                s->tx_buffer, s->tx_written);
              s->tx_count = s->tx_written = 0;
              s->intctl |= MIPSNET_INTCTL_TXDONE;
              s->busy = 1;

reply via email to

[Prev in Thread] Current Thread [Next in Thread]