From patchwork Mon Apr 11 13:37:40 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 8801721 Return-Path: X-Original-To: patchwork-qemu-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 93DE79F36E for ; Mon, 11 Apr 2016 13:38:07 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id F3DD1201B9 for ; Mon, 11 Apr 2016 13:38:06 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 105292015A for ; Mon, 11 Apr 2016 13:38:06 +0000 (UTC) Received: from localhost ([::1]:55118 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1apc2X-0007pr-2j for patchwork-qemu-devel@patchwork.kernel.org; Mon, 11 Apr 2016 09:38:05 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59089) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1apc2N-0007mr-EQ for qemu-devel@nongnu.org; Mon, 11 Apr 2016 09:37:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1apc2M-0007Z2-GQ for qemu-devel@nongnu.org; Mon, 11 Apr 2016 09:37:55 -0400 Received: from orth.archaic.org.uk ([2001:8b0:1d0::2]:56358) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1apc2M-0007UM-9H for qemu-devel@nongnu.org; Mon, 11 Apr 2016 09:37:54 -0400 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.84_2) (envelope-from ) id 1apc2A-0006k7-BP for qemu-devel@nongnu.org; Mon, 11 Apr 2016 14:37:42 +0100 From: Peter Maydell To: qemu-devel@nongnu.org Date: Mon, 11 Apr 2016 14:37:40 +0100 Message-Id: <1460381860-20998-2-git-send-email-peter.maydell@linaro.org> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1460381860-20998-1-git-send-email-peter.maydell@linaro.org> References: <1460381860-20998-1-git-send-email-peter.maydell@linaro.org> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:8b0:1d0::2 Subject: [Qemu-devel] [PULL 1/1] net: stellaris_enet: check packet length against receive buffer X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Prasad J Pandit When receiving packets over Stellaris ethernet controller, it uses receive buffer of size 2048 bytes. In case the controller accepts large(MTU) packets, it could lead to memory corruption. Add check to avoid it. Reported-by: Oleksandr Bazhaniuk Signed-off-by: Prasad J Pandit Message-id: 1460095428-22698-1-git-send-email-ppandit@redhat.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/net/stellaris_enet.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/hw/net/stellaris_enet.c b/hw/net/stellaris_enet.c index 84cf60b..6880894 100644 --- a/hw/net/stellaris_enet.c +++ b/hw/net/stellaris_enet.c @@ -236,8 +236,18 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si n = s->next_packet + s->np; if (n >= 31) n -= 31; - s->np++; + if (size >= sizeof(s->rx[n].data) - 6) { + /* If the packet won't fit into the + * emulated 2K RAM, this is reported + * as a FIFO overrun error. + */ + s->ris |= SE_INT_FOV; + stellaris_enet_update(s); + return -1; + } + + s->np++; s->rx[n].len = size + 6; p = s->rx[n].data; *(p++) = (size + 6);