mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
e781139539
qemu/hw/net
History
Mauro Matteo Cascella 035e69b063 hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() 
An assertion failure issue was found in the code that processes network packets
while adding data fragments into the packet context. It could be abused by a
malicious guest to abort the QEMU process on the host. This patch replaces the
affected assert() with a conditional statement, returning false if the current
data fragment exceeds max_raw_frags.

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com>
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2020-08-04 14:14:48 +08:00
..
can qom: Drop parameter @errp of object_property_add() & friends 2020-05-15 07:07:58 +02:00
fsl_etsec sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
rocker hw/net/rocker: Report unimplemented feature with qemu_log_mask(UNIMP) 2020-02-18 20:20:49 +01:00
allwinner_emac.c hw/net: Make NetCanReceive() return a boolean 2020-03-31 21:14:35 +08:00
allwinner-sun8i-emac.c hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads 2020-03-31 21:14:35 +08:00
cadence_gem.c net: cadence_gem: Fix RX address filtering 2020-06-18 21:05:52 +08:00
dp8393x.c hw/net: Make NetCanReceive() return a boolean 2020-03-31 21:14:35 +08:00
e1000_regs.h e1000: Rename the SEC symbol to SEQEC 2017-09-08 08:17:37 +08:00
e1000.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
e1000e_core.c hw/net/e1000e: Do not abort() on invalid PSRCTL register value 2020-06-18 21:05:52 +08:00
e1000e_core.h hw/net/e1000e_core: Let e1000e_can_receive() return a boolean 2020-03-31 21:14:35 +08:00
e1000e.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
e1000x_common.c Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
e1000x_common.h Supply missing header guards 2019-06-12 13:20:21 +02:00
eepro100.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
etraxfs_eth.c sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
ftgmac100.c ftgmac100: fix dblac write test 2020-07-15 21:00:13 +08:00
i82596.c hw/net: Make NetCanReceive() return a boolean 2020-03-31 21:14:35 +08:00
i82596.h hw/net: Make NetCanReceive() return a boolean 2020-03-31 21:14:35 +08:00
imx_fec.c Add a phy-num property to the i.MX FEC emulator 2020-07-03 16:59:41 +01:00
Kconfig hw/arm/allwinner-h3: add EMAC ethernet device 2020-03-12 16:27:33 +00:00
lan9118.c sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
lance.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
lasi_i82596.c sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
Makefile.objs virtio-net: implement RX RSS processing 2020-06-18 21:05:50 +08:00
mcf_fec.c hw/m68k/mcf52xx: Replace hw_error() by qemu_log_mask() 2020-05-30 09:17:46 +02:00
milkymist-minimac2.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
mipsnet.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
msf2-emac.c hw/net: Add Smartfusion2 emac block 2020-04-30 11:52:28 +01:00
ne2000-isa.c qom: Put name parameter before value / visitor parameter 2020-07-10 15:18:08 +02:00
ne2000-pci.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
ne2000.c Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
ne2000.h Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
net_rx_pkt.c NetRxPkt: fix hash calculation of IPV6 TCP 2020-03-03 18:04:47 +08:00
net_rx_pkt.h NetRxPkt: Introduce support for additional hash types 2020-03-03 18:04:47 +08:00
net_tx_pkt.c hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() 2020-08-04 14:14:48 +08:00
net_tx_pkt.h hw/net: Added plen fix for IPv6 2020-07-21 21:30:39 +08:00
opencores_eth.c hw/net: Make NetCanReceive() return a boolean 2020-03-31 21:14:35 +08:00
pcnet-pci.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
pcnet.c Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
pcnet.h lance: replace PROP_PTR with PROP_LINK 2020-01-07 17:24:29 +04:00
rtl8139.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
smc91c111.c sysbus: Convert to sysbus_realize() etc. with Coccinelle 2020-06-15 22:05:28 +02:00
spapr_llan.c qdev: Convert uses of qdev_create() with Coccinelle 2020-06-15 22:00:10 +02:00
stellaris_enet.c qdev: set properties with device_class_set_props() 2020-01-24 20:59:15 +01:00
sungem.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
sunhme.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
trace-events Add a phy-num property to the i.MX FEC emulator 2020-07-03 16:59:41 +01:00
tulip.c hw/net/tulip: Log descriptor overflows 2020-06-18 21:05:51 +08:00
tulip.h hw/net/tulip: Fix 'Descriptor Error' definition 2020-06-18 21:05:51 +08:00
vhost_net-stub.c vhost_net: introduce set_config & get_config 2020-07-03 07:57:04 -04:00
vhost_net.c vhost-vdpa: introduce vhost-vdpa backend 2020-07-07 07:59:51 -04:00
virtio-net.c virtio-net: check the existence of peer before accessing vDPA config 2020-07-28 16:57:58 +08:00
vmware_utils.h hw/net/vmxnet3: Fix code to work on big endian hosts, too 2017-11-20 11:08:00 +08:00
vmxnet3_defs.h Supply missing header guards 2019-06-12 13:20:21 +02:00
vmxnet3.c Drop more @errp parameters after previous commit 2020-05-15 07:08:14 +02:00
vmxnet3.h hw/net/vmxnet3: Fix code to work on big endian hosts, too 2017-11-20 11:08:00 +08:00
vmxnet_debug.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
xen_nic.c Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
xgmac.c hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() 2020-07-21 21:30:39 +08:00
xilinx_axienet.c qom: Put name parameter before value / visitor parameter 2020-07-10 15:18:08 +02:00
xilinx_ethlite.c hw/net: Make NetCanReceive() return a boolean 2020-03-31 21:14:35 +08:00