[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2 0/2] Avoid sending zero-size packets
From: |
Oleinik, Alexander |
Subject: |
[Qemu-devel] [PATCH v2 0/2] Avoid sending zero-size packets |
Date: |
Mon, 22 Jul 2019 13:24:44 +0000 |
While fuzzing the virtio-net tx vq, I ran into an assertion failure due
to iov_copy offsets larger than the total iov size. Though there is
a check to cover this, it does not execute when !n->has_vnet_hdr. This
patch tries to fix this.
The call stack for the assertion failure:
#8 in __assert_fail (libc.so.6+0x300f1)
#9 in iov_copy iov.c:266:5
#10 in virtio_net_flush_tx virtio-net.c:2073:23
#11 in virtio_net_tx_bh virtio-net.c:2197:11
#12 in aio_bh_poll async.c:118:13
#13 in aio_dispatch aio-posix.c:460:5
#14 in aio_ctx_dispatch async.c:261:5
#15 in g_main_context_dispatch (libglib-2.0.so.0+0x4df2d)
#16 in glib_pollfds_poll main-loop.c:213:9
#17 in os_host_main_loop_wait main-loop.c:236
#18 in main_loop_wait main-loop.c:512
#19 in virtio_net_tx_fuzz virtio-net-fuzz.c:160:3
v2: add details to comment for the change to qemu_sendv_packet_async
Alexander Oleinik (2):
net: assert that tx packets have nonzero size
virtio-net: check that tx packet has positive size
hw/net/virtio-net.c | 15 +++++++++------
net/net.c | 9 +++++++++
2 files changed, 18 insertions(+), 6 deletions(-)
--
2.20.1
- [Qemu-devel] [PATCH v2 0/2] Avoid sending zero-size packets,
Oleinik, Alexander <=