* [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written
[not found] <162441284292.15618.4627728437912000813-0@git.sr.ht>
@ 2021-06-23 2:26 ` Qiang Liu
2021-06-23 3:23 ` Jason Wang
0 siblings, 1 reply; 4+ messages in thread
From: Qiang Liu @ 2021-06-23 2:26 UTC (permalink / raw)
To: Dmitry Fleytman, Jason Wang, qemu-devel
From: cyruscyliu <cyruscyliu@gmail.com>
A malicious guest user can write VMXNET3_REG_ICR to crash QEMU. This
patch remove the g_aasert_not_reached() there and make the access pass.
Fixes: 786fd2b0f87 ("VMXNET3 device implementation")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/309
Buglink: https://bugs.launchpad.net/qemu/+bug/1913923
Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
---
hw/net/vmxnet3.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index eff299f629..a388918479 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -1786,13 +1786,6 @@ vmxnet3_io_bar1_write(void *opaque,
vmxnet3_set_variable_mac(s, val, s->temp_mac);
break;
- /* Interrupt Cause Register */
- case VMXNET3_REG_ICR:
- VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d",
- val, size);
- g_assert_not_reached();
- break;
-
/* Event Cause Register */
case VMXNET3_REG_ECR:
VMW_CBPRN("Write BAR1 [VMXNET3_REG_ECR] = %" PRIx64 ", size %d",
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written
2021-06-23 2:26 ` [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written Qiang Liu
@ 2021-06-23 3:23 ` Jason Wang
2021-06-25 2:19 ` Qiang Liu
0 siblings, 1 reply; 4+ messages in thread
From: Jason Wang @ 2021-06-23 3:23 UTC (permalink / raw)
To: Qiang Liu, Dmitry Fleytman, qemu-devel
在 2021/6/23 上午10:26, Qiang Liu 写道:
> From: cyruscyliu <cyruscyliu@gmail.com>
>
> A malicious guest user can write VMXNET3_REG_ICR to crash QEMU. This
> patch remove the g_aasert_not_reached() there and make the access pass.
>
> Fixes: 786fd2b0f87 ("VMXNET3 device implementation")
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/309
> Buglink: https://bugs.launchpad.net/qemu/+bug/1913923
>
> Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
Do we need to warn about the unimplemented register?
Thanks
> ---
> hw/net/vmxnet3.c | 7 -------
> 1 file changed, 7 deletions(-)
>
> diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
> index eff299f629..a388918479 100644
> --- a/hw/net/vmxnet3.c
> +++ b/hw/net/vmxnet3.c
> @@ -1786,13 +1786,6 @@ vmxnet3_io_bar1_write(void *opaque,
> vmxnet3_set_variable_mac(s, val, s->temp_mac);
> break;
>
> - /* Interrupt Cause Register */
> - case VMXNET3_REG_ICR:
> - VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d",
> - val, size);
> - g_assert_not_reached();
> - break;
> -
> /* Event Cause Register */
> case VMXNET3_REG_ECR:
> VMW_CBPRN("Write BAR1 [VMXNET3_REG_ECR] = %" PRIx64 ", size %d",
> --
> 2.30.2
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written
2021-06-23 3:23 ` Jason Wang
@ 2021-06-25 2:19 ` Qiang Liu
2021-06-25 2:57 ` Jason Wang
0 siblings, 1 reply; 4+ messages in thread
From: Qiang Liu @ 2021-06-25 2:19 UTC (permalink / raw)
To: Jason Wang; +Cc: Dmitry Fleytman, open list:All patches CC here
Hi,
On Wed, Jun 23, 2021 at 11:23 AM Jason Wang <jasowang@redhat.com> wrote:
>
>
> 在 2021/6/23 上午10:26, Qiang Liu 写道:
> > From: cyruscyliu <cyruscyliu@gmail.com>
> >
> > A malicious guest user can write VMXNET3_REG_ICR to crash QEMU. This
> > patch remove the g_aasert_not_reached() there and make the access pass.
> >
> > Fixes: 786fd2b0f87 ("VMXNET3 device implementation")
> > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/309
> > Buglink: https://bugs.launchpad.net/qemu/+bug/1913923
> >
> > Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
>
>
> Do we need to warn about the unimplemented register?
If we remove the case branch, it will go to the default branch which
can warn users if
VMXNET_DEBUG_CB_ENABLED is defined, so there is no need to warn this
unimplemented register. Am I right?
```
vmxnet3_io_bar1_write(...
default:
VMW_CBPRN("Unknown Write to BAR1 [%" PRIx64 "] = %" PRIx64 ", size %d",
addr, val, size);
break;
```
> Thanks
>
>
> > ---
> > hw/net/vmxnet3.c | 7 -------
> > 1 file changed, 7 deletions(-)
> >
> > diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
> > index eff299f629..a388918479 100644
> > --- a/hw/net/vmxnet3.c
> > +++ b/hw/net/vmxnet3.c
> > @@ -1786,13 +1786,6 @@ vmxnet3_io_bar1_write(void *opaque,
> > vmxnet3_set_variable_mac(s, val, s->temp_mac);
> > break;
> >
> > - /* Interrupt Cause Register */
> > - case VMXNET3_REG_ICR:
> > - VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d",
> > - val, size);
> > - g_assert_not_reached();
> > - break;
> > -
> > /* Event Cause Register */
> > case VMXNET3_REG_ECR:
> > VMW_CBPRN("Write BAR1 [VMXNET3_REG_ECR] = %" PRIx64 ", size %d",
> > --
> > 2.30.2
> >
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written
2021-06-25 2:19 ` Qiang Liu
@ 2021-06-25 2:57 ` Jason Wang
0 siblings, 0 replies; 4+ messages in thread
From: Jason Wang @ 2021-06-25 2:57 UTC (permalink / raw)
To: Qiang Liu; +Cc: Dmitry Fleytman, open list:All patches CC here
在 2021/6/25 上午10:19, Qiang Liu 写道:
> Hi,
> On Wed, Jun 23, 2021 at 11:23 AM Jason Wang <jasowang@redhat.com> wrote:
>>
>> 在 2021/6/23 上午10:26, Qiang Liu 写道:
>>> From: cyruscyliu <cyruscyliu@gmail.com>
>>>
>>> A malicious guest user can write VMXNET3_REG_ICR to crash QEMU. This
>>> patch remove the g_aasert_not_reached() there and make the access pass.
>>>
>>> Fixes: 786fd2b0f87 ("VMXNET3 device implementation")
>>> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/309
>>> Buglink: https://bugs.launchpad.net/qemu/+bug/1913923
>>>
>>> Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
>>
>> Do we need to warn about the unimplemented register?
> If we remove the case branch, it will go to the default branch which
> can warn users if
> VMXNET_DEBUG_CB_ENABLED is defined, so there is no need to warn this
> unimplemented register. Am I right?
> ```
> vmxnet3_io_bar1_write(...
> default:
> VMW_CBPRN("Unknown Write to BAR1 [%" PRIx64 "] = %" PRIx64 ", size %d",
> addr, val, size);
> break;
> ```
Right.
I've queued this patch.
Thanks
>> Thanks
>>
>>
>>> ---
>>> hw/net/vmxnet3.c | 7 -------
>>> 1 file changed, 7 deletions(-)
>>>
>>> diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
>>> index eff299f629..a388918479 100644
>>> --- a/hw/net/vmxnet3.c
>>> +++ b/hw/net/vmxnet3.c
>>> @@ -1786,13 +1786,6 @@ vmxnet3_io_bar1_write(void *opaque,
>>> vmxnet3_set_variable_mac(s, val, s->temp_mac);
>>> break;
>>>
>>> - /* Interrupt Cause Register */
>>> - case VMXNET3_REG_ICR:
>>> - VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d",
>>> - val, size);
>>> - g_assert_not_reached();
>>> - break;
>>> -
>>> /* Event Cause Register */
>>> case VMXNET3_REG_ECR:
>>> VMW_CBPRN("Write BAR1 [VMXNET3_REG_ECR] = %" PRIx64 ", size %d",
>>> --
>>> 2.30.2
>>>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-06-25 2:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <162441284292.15618.4627728437912000813-0@git.sr.ht>
2021-06-23 2:26 ` [PATCH qemu] hw/net/vmxnet3: Remove g_assert_not_reached() when VMXNET3_REG_ICR is written Qiang Liu
2021-06-23 3:23 ` Jason Wang
2021-06-25 2:19 ` Qiang Liu
2021-06-25 2:57 ` Jason Wang
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.