ae37a72f4c
- pci-host: designware: Limit value range of iATU viewport register - hmat acpi: Fix out of bounds access due to missing use of indirection - migration: Skip only empty block devices - aspeed/hace: Initialize g_autofree pointer - hw/net/vmxnet3: Fix guest-triggerable assert() - qxl: don't assert() if device isn't yet initialized - Avoid unaligned fetch in ladr_match() - linux-user: Fix waitid return of siginfo_t and rusage - hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition - stdvga: fix screen blanking - virtio-net: drop too short packets early - ebpf: replace deprecated bpf_program__set_socket_filter - vhsot-user: only read reply of SET_LOG_BASE from vq 0 - cpu: add Tengyun S5000C cpu support - hw/virtio: Fix obtain the buffer id from the last descriptor - hw/core: ensure kernel_end never gets used undefined Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit 1f9e476e96edb07e34e0133a312f478ddab4b6ff)
46 lines
1.8 KiB
Diff
46 lines
1.8 KiB
Diff
From 2c4d30134778dc9219a883243d207f9dff9f0a7e Mon Sep 17 00:00:00 2001
|
|
From: Thomas Huth <thuth@redhat.com>
|
|
Date: Thu, 17 Aug 2023 14:56:00 +0200
|
|
Subject: [PATCH] hw/net/vmxnet3: Fix guest-triggerable assert()
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
The assert() that checks for valid MTU sizes can be triggered by
|
|
the guest (e.g. with the reproducer code from the bug ticket
|
|
https://gitlab.com/qemu-project/qemu/-/issues/517 ). Let's avoid
|
|
this problem by simply logging the error and refusing to activate
|
|
the device instead.
|
|
|
|
Fixes: d05dcd94ae ("net: vmxnet3: validate configuration values during activate")
|
|
Signed-off-by: Thomas Huth <thuth@redhat.com>
|
|
Cc: qemu-stable@nongnu.org
|
|
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
|
|
[Mjt: change format specifier from %d to %u for uint32_t argument]
|
|
(cherry picked from commit 90a0778421acdf4ca903be64c8ed19378183c944)
|
|
Signed-off-by: zhujun2 <zhujun2_yewu@cmss.chinamobile.com>
|
|
---
|
|
hw/net/vmxnet3.c | 5 ++++-
|
|
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
|
|
index 2a32ab32ea..674b3a6946 100644
|
|
--- a/hw/net/vmxnet3.c
|
|
+++ b/hw/net/vmxnet3.c
|
|
@@ -1441,7 +1441,10 @@ static void vmxnet3_activate_device(VMXNET3State *s)
|
|
vmxnet3_setup_rx_filtering(s);
|
|
/* Cache fields from shared memory */
|
|
s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
|
|
- assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu <= VMXNET3_MAX_MTU);
|
|
+ if (s->mtu < VMXNET3_MIN_MTU || s->mtu > VMXNET3_MAX_MTU) {
|
|
+ qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Bad MTU size: %u\n", s->mtu);
|
|
+ return;
|
|
+ }
|
|
VMW_CFPRN("MTU is %u", s->mtu);
|
|
|
|
s->max_rx_frags =
|
|
--
|
|
2.41.0.windows.1
|
|
|