[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] net: mipsnet: check transmit buffer size before

From: Jason Wang
Subject: Re: [Qemu-devel] [PATCH] net: mipsnet: check transmit buffer size before sending
Date: Tue, 14 Jun 2016 11:48:05 +0800
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0

On 2016年06月13日 16:35, Aurelien Jarno wrote:
On 2016-06-02 10:28, Peter Maydell wrote:
On 2 June 2016 at 07:44, P J P <address@hidden> wrote:
From: Prasad J Pandit <address@hidden>

When processing MIPSnet I/O port write operation, it uses a
transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices
's->tx_written' and 's->tx_count' are used to control data written
to this buffer. If the two were to be equal before writing, it'd
lead to an OOB write access beyond tx_buffer. Add check to avoid it.

Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
  hw/net/mipsnet.c | 10 ++++++----
  1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
index 740cd98..8d5e5bf 100644
--- a/hw/net/mipsnet.c
+++ b/hw/net/mipsnet.c
@@ -158,7 +158,7 @@ static void mipsnet_ioport_write(void *opaque, hwaddr addr,
      trace_mipsnet_write(addr, val);
      switch (addr) {
-       s->tx_count = (val <= MAX_ETH_FRAME_SIZE) ? val : 0;
+        s->tx_count = (val < MAX_ETH_FRAME_SIZE) ? val : MAX_ETH_FRAME_SIZE;
          s->tx_written = 0;
This is a behaviour change -- the register will now read
back as MAX_ETH_FRAME_SIZE rather than 0 if written with
an overlarge value.

Do we have any documentation on how this (simulated)
device is supposed to behave in this case?
This device is not supported by the linux kernel for more than 2.5 years
(since v3.7). Do we want to keep this device in QEMU?


Right, so I suggest to remove this from qemu.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]