From patchwork Tue Aug 9 07:34:31 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 9270553 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 315CD60754 for ; Tue, 9 Aug 2016 07:35:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 269E3283F8 for ; Tue, 9 Aug 2016 07:35:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1B48C28415; Tue, 9 Aug 2016 07:35:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 67E93283F8 for ; Tue, 9 Aug 2016 07:35:19 +0000 (UTC) Received: from localhost ([::1]:33972 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bX1ZG-00012D-FJ for patchwork-qemu-devel@patchwork.kernel.org; Tue, 09 Aug 2016 03:35:18 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48665) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bX1Yi-00010z-3V for qemu-devel@nongnu.org; Tue, 09 Aug 2016 03:34:45 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bX1Ye-0003fo-8D for qemu-devel@nongnu.org; Tue, 09 Aug 2016 03:34:43 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40556) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bX1Ye-0003fk-2y; Tue, 09 Aug 2016 03:34:40 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A95A483F41; Tue, 9 Aug 2016 07:34:39 +0000 (UTC) Received: from jason-ThinkPad-T450s.redhat.com (vpn1-4-112.pek2.redhat.com [10.72.4.112]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u797YYPV006454; Tue, 9 Aug 2016 03:34:37 -0400 From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Date: Tue, 9 Aug 2016 15:34:31 +0800 Message-Id: <1470728073-30141-2-git-send-email-jasowang@redhat.com> In-Reply-To: <1470728073-30141-1-git-send-email-jasowang@redhat.com> References: <1470728073-30141-1-git-send-email-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Tue, 09 Aug 2016 07:34:39 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 1/3] net: check fragment length during fragmentation X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jason Wang , Prasad J Pandit , qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Prasad J Pandit Network transport abstraction layer supports packet fragmentation. While fragmenting a packet, it checks for more fragments from packet length and current fragment length. It is susceptible to an infinite loop, if the current fragment length is zero. Add check to avoid it. Reported-by: Li Qiang Signed-off-by: Prasad J Pandit Reviewed-by: Dmitry Fleytman CC: qemu-stable@nongnu.org Signed-off-by: Jason Wang --- hw/net/net_tx_pkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c index efd43b4..53dfaa2 100644 --- a/hw/net/net_tx_pkt.c +++ b/hw/net/net_tx_pkt.c @@ -590,7 +590,7 @@ static bool net_tx_pkt_do_sw_fragmentation(struct NetTxPkt *pkt, fragment_offset += fragment_len; - } while (more_frags); + } while (fragment_len && more_frags); return true; }