48 lines
1.8 KiB
Diff
48 lines
1.8 KiB
Diff
|
From 2d7c5ea10b443c33ffe2c21de5a495bd6d2a67bd Mon Sep 17 00:00:00 2001
|
||
|
|
From: qihao <qihao_yewu@cmss.chinamobile.com>
|
||
|
|
Date: Wed, 28 Jun 2023 09:37:04 +0800
|
||
|
|
Subject: [PATCH] hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value
|
||
|
|
|
||
|
|
cheery-pick from b209cc4556d56938fa8a933670b8fb98c036af37
|
||
|
|
|
||
|
|
Currently, VMXNET3_MAX_MTU itself (being 9000) is not considered a
|
||
|
|
valid value for the MTU, but a guest running ESXi 7.0 might try to
|
||
|
|
set it and fail the assert [0].
|
||
|
|
|
||
|
|
In the Linux kernel, dev->max_mtu itself is a valid value for the MTU
|
||
|
|
and for the vmxnet3 driver it's 9000, so a guest running Linux will
|
||
|
|
also fail the assert when trying to set an MTU of 9000.
|
||
|
|
|
||
|
|
VMXNET3_MAX_MTU and s->mtu don't seem to be used in relation to buffer
|
||
|
|
allocations/accesses, so allowing the upper limit itself as a value
|
||
|
|
should be fine.
|
||
|
|
|
||
|
|
[0]: https://forum.proxmox.com/threads/114011/
|
||
|
|
|
||
|
|
Fixes: d05dcd94ae ("net: vmxnet3: validate configuration values during activate (CVE-2021-20203)")
|
||
|
|
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
|
||
|
|
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
||
|
|
(cherry picked from commit 099a63828130843741d317cb28e936f468b2b53b)
|
||
|
|
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
|
||
|
|
Signed-off-by: qihao_yewu <qihao_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
hw/net/vmxnet3.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
|
||
|
|
index 0b7acf7f89..a2037583bf 100644
|
||
|
|
--- a/hw/net/vmxnet3.c
|
||
|
|
+++ b/hw/net/vmxnet3.c
|
||
|
|
@@ -1441,7 +1441,7 @@ static void vmxnet3_activate_device(VMXNET3State *s)
|
||
|
|
vmxnet3_setup_rx_filtering(s);
|
||
|
|
/* Cache fields from shared memory */
|
||
|
|
s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
|
||
|
|
- assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu < VMXNET3_MAX_MTU);
|
||
|
|
+ assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu <= VMXNET3_MAX_MTU);
|
||
|
|
VMW_CFPRN("MTU is %u", s->mtu);
|
||
|
|
|
||
|
|
s->max_rx_frags =
|
||
|
|
--
|
||
|
|
2.41.0.windows.1
|
||
|
|
|