On Apr 3, 2014, at 19:07 PM, Michael S. Tsirkin <mst@redhat.com> wrote:

> On Tue, Apr 01, 2014 at 02:07:52PM +0100, Dr. David Alan Gilbert wrote:
>> * Dmitry Fleytman (dmitry@daynix.com) wrote:
>>> 
>>> On Apr 1, 2014, at 14:33 PM, Dr. David Alan Gilbert <dgilbert@redhat.com> wrote:
>>> 
>>>> * Michael S. Tsirkin (mst@redhat.com) wrote:
>>>>> From: Dmitry Fleytman <dmitry@daynix.com>
>>>>> 
>>>>> CVE-2013-4544
>>>>> 
>>>>> Signed-off-by: Dmitry Fleytman <dmitry@daynix.com>
>>>>> Reported-by: Michael S. Tsirkin <mst@redhat.com>
>>>>> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
>>>>> ---
>>>>> hw/net/vmxnet3.c | 36 ++++++++++++++++++++++++++++++++++--
>>>>> 1 file changed, 34 insertions(+), 2 deletions(-)
>>>>> 
>>>>> diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
>>>>> index 5be807c..a4b5c11 100644
>>>>> --- a/hw/net/vmxnet3.c
>>>>> +++ b/hw/net/vmxnet3.c
>>>>> @@ -52,6 +52,9 @@
>>>>> #define VMXNET3_DEVICE_VERSION    0x1
>>>>> #define VMXNET3_DEVICE_REVISION   0x1
>>>>> 
>>>>> +/* Number of interrupt vectors for INTx/MSI */
>>>>> +#define VMXNET3_MAX_NMSIX_INTRS   (1)
>>>> 
>>>> As per Dmitry's reply this is apparently the number of non-MSIX
>>>> interrupts; can we change the comment to make this clear.
>>> 
>>> Not sure how to change it.
>>> There are three modes of operation:
>>> 1. INTx - 1 interrupt is used
>>> 2. MSI - 1 interrupt is used
>>> 3. MSIx - up to 25 interrupts are used.
>>> 
>>> This define covers 2 first modes of operation.
>>> Would something like
>>> 
>>> /* Number of interrupt vectors for non-MSIx modes */
>>> 
>>> be better?
>> 
>> Yes - that's fine.
>> 
>> Dave
> 
> 
> OK Dmitry, can you please resend patches with suggested comment changes?

Done. Sent to the list.

> 
>>> 
>>> 
>>>> 
>>>>> +
>>>>> /* Macros for rings descriptors access */
>>>>> #define VMXNET3_READ_TX_QUEUE_DESCR8(dpa, field) \
>>>>>    (vmw_shmem_ld8(dpa + offsetof(struct Vmxnet3_TxQueueDesc, field)))
>>>>> @@ -1305,6 +1308,34 @@ static bool vmxnet3_verify_intx(VMXNET3State *s, int intx)
>>>>>           (pci_get_byte(s->parent_obj.config + PCI_INTERRUPT_PIN) - 1));
>>>>> }
>>>>> 
>>>>> +static void vmxnet3_validate_interrupt_idx(bool is_msix, int idx)
>>>>> +{
>>>>> +    int max_ints = is_msix ? VMXNET3_MAX_INTRS : VMXNET3_MAX_NMSIX_INTRS;
>>>>> +    if (idx >= max_ints) {
>>>>> +        hw_error("Bad interrupt index: %d\n", idx);
>>>>> +    }
>>>> 
>>>> Can we avoid hw_error here, we're using in this in state load, so I'm
>>>> OK at the thought of error_report, but then we should make
>>>> this return a bool to say it's failed and bubble this up so
>>>> that it just fails the post_load test    like any other bad state load.
>>>> 
>>>> Dave
>>>> 
>>>>> +}
>>>>> +
>>>>> +static void vmxnet3_validate_interrupts(VMXNET3State *s)
>>>>> +{
>>>>> +    int i;
>>>>> +
>>>>> +    VMW_CFPRN("Verifying event interrupt index (%d)", s->event_int_idx);
>>>>> +    vmxnet3_validate_interrupt_idx(s->msix_used, s->event_int_idx);
>>>>> +
>>>>> +    for (i = 0; i < s->txq_num; i++) {
>>>>> +        int idx = s->txq_descr[i].intr_idx;
>>>>> +        VMW_CFPRN("Verifying TX queue %d interrupt index (%d)", i, idx);
>>>>> +        vmxnet3_validate_interrupt_idx(s->msix_used, idx);
>>>>> +    }
>>>>> +
>>>>> +    for (i = 0; i < s->rxq_num; i++) {
>>>>> +        int idx = s->rxq_descr[i].intr_idx;
>>>>> +        VMW_CFPRN("Verifying RX queue %d interrupt index (%d)", i, idx);
>>>>> +        vmxnet3_validate_interrupt_idx(s->msix_used, idx);
>>>>> +    }
>>>>> +}
>>>>> +
>>>>> static void vmxnet3_activate_device(VMXNET3State *s)
>>>>> {
>>>>>    int i;
>>>>> @@ -1447,6 +1478,8 @@ static void vmxnet3_activate_device(VMXNET3State *s)
>>>>>               sizeof(s->rxq_descr[i].rxq_stats));
>>>>>    }
>>>>> 
>>>>> +    vmxnet3_validate_interrupts(s);
>>>>> +
>>>>>    /* Make sure everything is in place before device activation */
>>>>>    smp_wmb();
>>>>> 
>>>>> @@ -2005,7 +2038,6 @@ vmxnet3_cleanup_msix(VMXNET3State *s)
>>>>>    }
>>>>> }
>>>>> 
>>>>> -#define VMXNET3_MSI_NUM_VECTORS   (1)
>>>>> #define VMXNET3_MSI_OFFSET        (0x50)
>>>>> #define VMXNET3_USE_64BIT         (true)
>>>>> #define VMXNET3_PER_VECTOR_MASK   (false)
>>>>> @@ -2016,7 +2048,7 @@ vmxnet3_init_msi(VMXNET3State *s)
>>>>>    PCIDevice *d = PCI_DEVICE(s);
>>>>>    int res;
>>>>> 
>>>>> -    res = msi_init(d, VMXNET3_MSI_OFFSET, VMXNET3_MSI_NUM_VECTORS,
>>>>> +    res = msi_init(d, VMXNET3_MSI_OFFSET, VMXNET3_MAX_NMSIX_INTRS,
>>>>>                   VMXNET3_USE_64BIT, VMXNET3_PER_VECTOR_MASK);
>>>>>    if (0 > res) {
>>>>>        VMW_WRPRN("Failed to initialize MSI, error %d", res);
>>>>> -- 
>>>>> MST
>>>>> 
>>>> --
>>>> Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
>>> 
>> --
>> Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK