Re: [PATCH] net: eepro100: validate various address values

[P J P <ppandit@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1624 bytes --]

  Hello Stefan,

+-- On Fri, 19 Feb 2021, Stefan Weil wrote --+
| If there are no recursions in normal use, the following patch should work:
| 
| diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
| index 16e95ef9cc..2474cf3dc2 100644
| --- a/hw/net/eepro100.c
| +++ b/hw/net/eepro100.c
| @@ -279,6 +279,9 @@ typedef struct {
|      /* Quasi static device properties (no need to save them). */
|      uint16_t stats_size;
|      bool has_extended_tcb_support;
| +
| +    /* Flag to avoid recursions. */
| +    bool busy;
|  } EEPRO100State;
| 
|  /* Word indices in EEPROM. */
| @@ -837,6 +840,14 @@ static void action_command(EEPRO100State *s)
|         Therefore we limit the number of iterations. */
|      unsigned max_loop_count = 16;
| 
| +    if (s->busy) {
| +        /* Prevent recursions. */
| +        logout("recursion in %s:%u\n", __FILE__, __LINE__);
| +        return;
| +    }
| +
| +    s->busy = true;
| +
|      for (;;) {
|          bool bit_el;
|          bool bit_s;
| @@ -933,6 +944,7 @@ static void action_command(EEPRO100State *s)
|      }
|      TRACE(OTHER, logout("CU list empty\n"));
|      /* List is empty. Now CU is idle or suspended. */
| +    s->busy = false;
|  }
| 
|  static void eepro100_cu_command(EEPRO100State * s, uint8_t val)

Please see:
  -> https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Feepro100_stackoverflow1

* It does not seem to address above case.

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D