mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6ce9033339
qemu/hw
History
Alexey Dobriyan 6ce9033339 virtio-net: drop too short packets early 
Reproducer from https://gitlab.com/qemu-project/qemu/-/issues/1451
creates small packet (1 segment, len = 10 == n->guest_hdr_len),
then destroys queue.

"if (n->host_hdr_len != n->guest_hdr_len)" is triggered, if body creates
zero length/zero segment packet as there is nothing after guest header.

qemu_sendv_packet_async() tries to send it.

slirp discards it because it is smaller than Ethernet header,
but returns 0 because tx hooks are supposed to return total length of data.

0 is propagated upwards and is interpreted as "packet has been sent"
which is terrible because queue is being destroyed, nobody is waiting for TX
to complete and assert it triggered.

Fix is discard such empty packets instead of sending them.

Length 1 packets will go via different codepath:

	virtqueue_push(q->tx_vq, elem, 0);
	virtio_notify(vdev, q->tx_vq);
	g_free(elem);

and aren't problematic.

Signed-off-by: Alexey Dobriyan <adobriyan@yandex-team.ru>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 2c3e4e2de6)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2024-06-11 10:09:49 +03:00
..
9pfs hw: replace most qemu_bh_new calls with qemu_bh_new_guarded 2023-09-11 10:53:50 +03:00
acpi hmat acpi: Fix out of bounds access due to missing use of indirection 2024-03-14 21:24:34 +03:00
adc
alpha hw: Remove unused MAX_IDE_BUS define 2022-10-31 11:32:07 +01:00
arm hw/arm/npcm7xx: Store derivative OTP fuse key in little endian 2024-05-02 13:17:18 +03:00
audio hw/audio/hda-codec: fix multiplication overflow 2023-12-20 19:11:10 +03:00
avr
block hw/block/nand: Fix out-of-bound access in NAND block buffer 2024-04-10 19:36:00 +03:00
char hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs 2024-04-10 19:27:04 +03:00
core hw/nvme: add machine compatibility parameter to enable msix exclusive bar 2024-03-14 21:24:34 +03:00
cpu
cris
cxl hw/cxl: Pass CXLComponentState to cache_mem_ops 2024-02-14 21:42:08 +03:00
display hw/display/virtio-gpu: Protect from DMA re-entrancy bugs 2024-04-10 19:25:48 +03:00
dma hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields 2024-05-02 13:16:29 +03:00
gpio hw/gpio/meson: Introduce dedicated config switch for hw/gpio/mpc8xxx 2022-10-17 16:15:09 -03:00
hppa target/hppa: Provide qemu version via fw_cfg to firmware 2023-06-26 19:35:29 +03:00
hyperv hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset() 2022-10-27 10:27:23 +01:00
i2c hw/i2c/aspeed: Fix TXBUF transmission start position error 2023-09-11 10:53:51 +03:00
i386 target/i386: the sgx_epc_get_section stub is reachable 2024-03-01 22:06:10 +03:00
ide hw/ide/ahci: fix legacy software reset 2023-11-22 14:25:06 +03:00
input lasips2: LASI PS/2 devices are not user-createable 2023-10-21 14:05:14 +03:00
intc hw/intc/riscv_aplic: APLICs should add child earlier than realize 2024-06-05 13:00:20 +03:00
ipack
ipmi
isa acpi: x86: move RPQx field back to _SB scope 2022-11-22 05:19:00 -05:00
loongarch Revert "hw/loongarch/virt: Add cfi01 pflash device" 2022-12-05 11:24:35 -05:00
m68k m68k/q800: do not re-randomize RNG seed on snapshot load 2022-10-27 11:34:31 +01:00
mem hw/mem/cxl-type3: Add CXL CDAT Data Object Exchange 2022-11-07 13:12:19 -05:00
microblaze hw/microblaze: pass random seed to fdt 2022-09-21 19:59:56 +02:00
mips hw/mips/malta: Fix the malta machine on big endian hosts 2023-12-20 19:11:10 +03:00
misc hw/misc/applesmc: Fix memory leak in reset() handler 2024-04-10 19:38:01 +03:00
net virtio-net: drop too short packets early 2024-06-11 10:09:49 +03:00
nios2 hw/nios2: set machine->fdt in nios2_load_dtb() 2022-10-17 16:15:10 -03:00
nubus
nvme hw/nvme: Use pcie_sriov_num_vfs() 2024-03-14 21:24:34 +03:00
nvram hw/nvram/xlnx-efuse-ctrl: Free XlnxVersalEFuseCtrl[] "pg0-lock" array 2023-12-20 19:11:10 +03:00
openrisc openrisc: re-randomize rng-seed on reboot 2022-10-27 11:34:31 +01:00
pci pcie_sriov: Validate NumVFs 2024-03-14 21:24:34 +03:00
pci-bridge hw/pci-bridge/cxl-upstream: Add a CDAT table access DOE 2022-11-07 13:12:19 -05:00
pci-host pci-host: designware: Limit value range of iATU viewport register 2024-02-03 16:45:54 +03:00
pcmcia
ppc ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS. 2024-04-16 21:16:12 +03:00
rdma hw/pvrdma: Protect against buggy or malicious guest driver 2023-10-21 14:05:14 +03:00
remote hw/remote/vfio-user: Fix config space access byte order 2024-05-10 13:20:20 +03:00
riscv hw/riscv: virt: Fix riscv,pmu DT node path 2023-09-13 12:21:22 +03:00
rtc hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later 2024-03-13 23:09:00 +03:00
rx rx: re-randomize rng-seed on reboot 2022-10-27 11:34:31 +01:00
s390x s390x/ap: fix missing subsystem reset registration 2023-09-13 21:57:05 +03:00
scsi hw/scsi/scsi-generic: Fix io_timeout property not applying 2024-04-09 20:09:20 +03:00
sd hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set 2024-04-10 20:20:51 +03:00
sensor
sh4
smbios hw/smbios: Fix port connector option validation 2024-02-13 21:06:28 +03:00
sparc
sparc64 hw: Remove unused MAX_IDE_BUS define 2022-10-31 11:32:07 +01:00
ssi aspeed/smc: Cache AspeedSMCClass 2022-10-24 11:20:15 +02:00
timer hw/timer/nrf51_timer: Don't lose time when timer is queried in tight loop 2023-06-22 10:38:38 +03:00
tpm hw/tpm: TIS on sysbus: Remove unsupport ppi command line option 2023-09-13 12:21:22 +03:00
tricore
usb hw/usb/bus.c: PCAP adding 0xA in Windows version 2024-03-01 18:59:25 +03:00
vfio vfio/pci: Disable INTx in vfio_realize error path 2023-08-05 08:39:54 +03:00
virtio hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs 2024-04-10 19:27:04 +03:00
watchdog watchdog: remove -watchdog option 2022-09-29 11:40:28 +02:00
xen xen/pt: reserve PCI slot 2 for Intel igd-passthru 2023-05-18 21:09:59 +03:00
xenpv
xtensa
Kconfig
meson.build