Message ID | 1460032529-26199-1-git-send-email-ppandit@redhat.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
On 7 April 2016 at 13:35, P J P <ppandit@redhat.com> wrote: > From: Prasad J Pandit <pjp@fedoraproject.org> > > When receiving packets over Stellaris ethernet controller, it > uses receive buffer of size 2048 bytes. In case the controller > accepts large(MTU) packets, it could lead to memory corruption. > Add check to avoid it. > > Reported by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com> > > Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> > --- > hw/net/stellaris_enet.c | 10 +++++++++- > 1 file changed, 9 insertions(+), 1 deletion(-) > > Update per review: > -> https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01142.html > > diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c > index 21a4773..eddbe60 100644 > --- a/hw/net/stellaris_enet.c > +++ b/hw/net/stellaris_enet.c > @@ -235,8 +235,16 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si > n = s->next_packet + s->np; > if (n >= 31) > n -= 31; > + if (size >= sizeof(s->rx[n].data) - 6) { > + /* If the packet won't fit into the > + * emulated 2K RAM, this is reported > + * as a FIFO overrun error. > + */ > + s->ris |= SE_INT_FOV; > + stellaris_enet_update(s); > + return -1; > + } I think you could reasonably put a blank line before and after the if() {} you've added here. > s->np++; > - Stray whitespace change. > s->rx[n].len = size + 6; > p = s->rx[n].data; > *(p++) = (size + 6); > -- > 2.5.5 > Otherwise Reviewed-by: Peter Maydell <peter.maydell@linaro.org> thanks -- PMM
+-- On Thu, 7 Apr 2016, Peter Maydell wrote --+ | I think you could reasonably put a blank line before and after | the if() {} you've added here. Sent a revised patch v3. Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c index 21a4773..eddbe60 100644 --- a/hw/net/stellaris_enet.c +++ b/hw/net/stellaris_enet.c @@ -235,8 +235,16 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si n = s->next_packet + s->np; if (n >= 31) n -= 31; + if (size >= sizeof(s->rx[n].data) - 6) { + /* If the packet won't fit into the + * emulated 2K RAM, this is reported + * as a FIFO overrun error. + */ + s->ris |= SE_INT_FOV; + stellaris_enet_update(s); + return -1; + } s->np++; - s->rx[n].len = size + 6; p = s->rx[n].data; *(p++) = (size + 6);