qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/2] assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c
@ 2020-07-27 17:08 Mauro Matteo Cascella
  2020-07-27 17:08 ` [PATCH 1/2] hw/net/net_tx_pkt: add function to check pkt->max_raw_frags Mauro Matteo Cascella
                   ` (2 more replies)
  0 siblings, 3 replies; 11+ messages in thread
From: Mauro Matteo Cascella @ 2020-07-27 17:08 UTC (permalink / raw)
  To: qemu-devel; +Cc: jasowang, dmitry.fleytman, mcascell, ezrakiez

An assertion failure issue was reported by Mr. Ziming Zhang (CC'd).
It occurs in the code that processes network packets while adding data
fragments into packet context. This flaw could potentially be abused by
a malicious guest to abort the QEMU process on the host. This two patch
series does a couple of things:

- introduces a new function in net_tx_pkt.{c,h} to check the maximum number
  of data fragments
- adds a check in both e1000e and vmxnet3 devices to skip the packet if the
  current data fragment exceeds max_raw_frags, preventing
  net_tx_pkt_add_raw_fragment() to be called with an invalid raw_frags

Mauro Matteo Cascella (2):
  hw/net/net_tx_pkt: add function to check pkt->max_raw_frags
  hw/net: check max_raw_frags in e1000e and vmxnet3 devices

 hw/net/e1000e_core.c | 3 ++-
 hw/net/net_tx_pkt.c  | 5 +++++
 hw/net/net_tx_pkt.h  | 8 ++++++++
 hw/net/vmxnet3.c     | 3 ++-
 4 files changed, 17 insertions(+), 2 deletions(-)

-- 
2.26.2



^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2020-07-31  3:34 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-27 17:08 [PATCH 0/2] assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c Mauro Matteo Cascella
2020-07-27 17:08 ` [PATCH 1/2] hw/net/net_tx_pkt: add function to check pkt->max_raw_frags Mauro Matteo Cascella
2020-07-28  4:06   ` Jason Wang
2020-07-28 16:26     ` Mauro Matteo Cascella
2020-07-30  5:27       ` Jason Wang
2020-07-30 17:05         ` Mauro Matteo Cascella
2020-07-31  3:33           ` Jason Wang
2020-07-27 17:08 ` [PATCH 2/2] hw/net: check max_raw_frags in e1000e and vmxnet3 devices Mauro Matteo Cascella
2020-07-27 17:29 ` [PATCH 0/2] assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c Alexander Bulekov
2020-07-28 16:59   ` Mauro Matteo Cascella
2020-07-29  8:48   ` Dmitry Fleytman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).