mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3de46e6fc4
qemu/hw/net
History
Jason Wang 3de46e6fc4 e1000: fail early for evil descriptor 
During procss_tx_desc(), driver can try to chain data descriptor with
legacy descriptor, when will lead underflow for the following
calculation in process_tx_desc() for bytes:

            if (tp->size + bytes > msh)
                bytes = msh - tp->size;

This will lead a infinite loop. So check and fail early if tp->size if
greater or equal to msh.

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de>
Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
2021-03-15 16:41:22 +08:00
..
can hw/net/can: Introduce Xilinx ZynqMP CAN controller 2020-12-10 11:30:44 +00:00
fsl_etsec hw/net: fsl_etsec: Fix build error when HEX_DUMP is on 2021-03-10 09:07:09 +11:00
rocker Machine queue, 2020-12-23 2021-01-01 22:57:15 +00:00
allwinner_emac.c hw/net: Make NetCanReceive() return a boolean 2020-03-31 21:14:35 +08:00
allwinner-sun8i-emac.c hw/net/allwinner-sun8i-emac: traverse transmit queue using TX_CUR_DESC register value 2021-03-12 12:40:10 +00:00
cadence_gem.c net: checksum: Introduce fine control over checksum type 2021-01-25 17:04:56 +08:00
dp8393x.c hw/net/dp8393x: fix integer underflow in dp8393x_do_transmit_packets() 2020-12-01 10:34:08 +00:00
e1000_regs.h
e1000.c e1000: fail early for evil descriptor 2021-03-15 16:41:22 +08:00
e1000e_core.c sysemu: Let VMChangeStateHandler take boolean 'running' argument 2021-03-09 23:13:57 +01:00
e1000e_core.h e1000e: Fix Lesser GPL version number 2020-11-15 16:45:49 +01:00
e1000e.c e1000e: Fix Lesser GPL version number 2020-11-15 16:45:49 +01:00
e1000x_common.c e1000e: Fix Lesser GPL version number 2020-11-15 16:45:49 +01:00
e1000x_common.h e1000e: Fix Lesser GPL version number 2020-11-15 16:45:49 +01:00
eepro100.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
etraxfs_eth.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
ftgmac100.c net: checksum: Introduce fine control over checksum type 2021-01-25 17:04:56 +08:00
i82596.c hw/net: Make NetCanReceive() return a boolean 2020-03-31 21:14:35 +08:00
i82596.h hw/net: Make NetCanReceive() return a boolean 2020-03-31 21:14:35 +08:00
imx_fec.c net: checksum: Introduce fine control over checksum type 2021-01-25 17:04:56 +08:00
Kconfig hw/net/can: Correct Kconfig dependencies 2020-09-30 19:11:37 +02:00
lan9118.c hw/net/lan9118: Add symbolic constants for register offsets 2021-01-12 21:19:02 +00:00
lance.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
lasi_i82596.c sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
mcf_fec.c mcf_fec: Move mcf_fec_state typedef to header 2020-08-27 14:04:54 -04:00
meson.build hw/net: Add npcm7xx emc model 2021-03-05 15:17:34 +00:00
milkymist-minimac2.c nomaintainer: Fix Lesser GPL version number 2020-11-15 17:04:40 +01:00
mipsnet.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
msf2-emac.c hw/net: Add Smartfusion2 emac block 2020-04-30 11:52:28 +01:00
ne2000-isa.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
ne2000-pci.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
ne2000.c
ne2000.h
net_rx_pkt.c NetRxPkt: fix hash calculation of IPV6 TCP 2020-03-03 18:04:47 +08:00
net_rx_pkt.h NetRxPkt: Introduce support for additional hash types 2020-03-03 18:04:47 +08:00
net_tx_pkt.c hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() 2020-08-04 14:14:48 +08:00
net_tx_pkt.h hw/net: Added plen fix for IPv6 2020-07-21 21:30:39 +08:00
npcm7xx_emc.c hw/net: Add npcm7xx emc model 2021-03-05 15:17:34 +00:00
opencores_eth.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
pcnet-pci.c Remove superfluous timer_del() calls 2021-01-08 15:13:38 +00:00
pcnet.c
pcnet.h
rtl8139.c Remove superfluous timer_del() calls 2021-01-08 15:13:38 +00:00
smc91c111.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
spapr_llan.c Remove superfluous timer_del() calls 2021-01-08 15:13:38 +00:00
stellaris_enet.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
sungem.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
sunhme.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
trace-events hw/net: Add npcm7xx emc model 2021-03-05 15:17:34 +00:00
trace.h trace: switch position of headers to what Meson requires 2020-08-21 06:18:24 -04:00
tulip.c tulip: Move TulipState typedef to header 2020-08-27 14:04:54 -04:00
tulip.h Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
vhost_net-stub.c vhost_net: introduce set_config & get_config 2020-07-03 07:57:04 -04:00
vhost_net.c vhost-vdpa: introduce vhost-vdpa backend 2020-07-07 07:59:51 -04:00
virtio-net.c virtio-net: handle zero mac for a vdpa peer 2021-03-02 06:09:54 -05:00
vmware_utils.h
vmxnet3_defs.h Use DECLARE_*CHECKER* macros 2020-09-09 09:27:09 -04:00
vmxnet3.c Use DECLARE_*CHECKER* macros 2020-09-09 09:27:09 -04:00
vmxnet3.h
vmxnet_debug.h
xen_nic.c net: checksum: Introduce fine control over checksum type 2021-01-25 17:04:56 +08:00
xgmac.c Use OBJECT_DECLARE_SIMPLE_TYPE when possible 2020-09-18 14:12:32 -04:00
xilinx_axienet.c hw/net/xilinx_axienet: Rename StreamSlave as StreamSink 2020-12-10 12:15:04 -05:00
xilinx_ethlite.c Use DECLARE_*CHECKER* macros 2020-09-09 09:27:09 -04:00