Re: [Qemu-devel] [PATCH 2/2] virtio-net: check that tx packet has positive size

[Stefan Hajnoczi]

On Fri, Jul 19, 2019 at 06:52:30PM +0000, Oleinik, Alexander wrote:
> virtio_net_flush_tx does not check that the packet size is nonzero,
> which causes q->aysnc_tx.elem to be set. Then, when the device is reset, there
> is an assertion failure since q->aysnc_tx.elem must be flushed/cleared.
> Zero-sized packets are unsupported - check packet size, prior to
> sending.
> 
> Found while fuzzing virtio-net. The relevant stack-trace:
>  #8 in __assert_fail (libc.so.6+0x30101)
>  #9 in virtio_net_reset virtio-net.c:520:13
>  #10 in virtio_reset virtio.c:1214:9
>  #11 in virtio_pci_reset virtio-pci.c:1810:5
>  #12 in qdev_reset_one qdev.c:259:5
>  #13 in qdev_walk_children qdev.c:575:15
>  #14 in qbus_walk_children bus.c:52:15
>  #15 in qdev_walk_children qdev.c:567:15
>  #16 in qbus_walk_children bus.c:52:15
>  #17 in qemu_devices_reset reset.c:69:9
>  #18 in pc_machine_reset pc.c:2628:5
>  #19 in qemu_system_reset vl.c:1621:9
>  #20 in LLVMFuzzerTestOneInput fuzz.c:184:4
> 
> Signed-off-by: Alexander Oleinik <address@hidden>
> ---
>  hw/net/virtio-net.c | 15 +++++++++------
>  1 file changed, 9 insertions(+), 6 deletions(-)

Reviewed-by: Stefan Hajnoczi <address@hidden>

signature.asc
Description: PGP signature