72 lines
2.7 KiB
Diff
72 lines
2.7 KiB
Diff
|
From c23034c79ad8632388bc00dd4268e429638eee9e Mon Sep 17 00:00:00 2001
|
||
|
|
From: qihao <qihao_yewu@cmss.chinamobile.com>
|
||
|
|
Date: Thu, 18 Apr 2024 14:45:15 +0800
|
||
|
|
Subject: [PATCH] hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
cheery-pick from 83ddb3dbba2ee0f1767442ae6ee665058aeb1093
|
||
|
|
|
||
|
|
If a fragmented packet size is too short, do not try to
|
||
|
|
calculate its checksum.
|
||
|
|
|
||
|
|
Reproduced using:
|
||
|
|
|
||
|
|
$ cat << EOF | qemu-system-i386 -display none -nodefaults \
|
||
|
|
-machine q35,accel=qtest -m 32M \
|
||
|
|
-device igb,netdev=net0 \
|
||
|
|
-netdev user,id=net0 \
|
||
|
|
-qtest stdio
|
||
|
|
outl 0xcf8 0x80000810
|
||
|
|
outl 0xcfc 0xe0000000
|
||
|
|
outl 0xcf8 0x80000804
|
||
|
|
outw 0xcfc 0x06
|
||
|
|
write 0xe0000403 0x1 0x02
|
||
|
|
writel 0xe0003808 0xffffffff
|
||
|
|
write 0xe000381a 0x1 0x5b
|
||
|
|
write 0xe000381b 0x1 0x00
|
||
|
|
EOF
|
||
|
|
Assertion failed: (offset == 0), function iov_from_buf_full, file util/iov.c, line 39.
|
||
|
|
#1 0x5575e81e952a in iov_from_buf_full qemu/util/iov.c:39:5
|
||
|
|
#2 0x5575e6500768 in net_tx_pkt_update_sctp_checksum qemu/hw/net/net_tx_pkt.c:144:9
|
||
|
|
#3 0x5575e659f3e1 in igb_setup_tx_offloads qemu/hw/net/igb_core.c:478:11
|
||
|
|
#4 0x5575e659f3e1 in igb_tx_pkt_send qemu/hw/net/igb_core.c:552:10
|
||
|
|
#5 0x5575e659f3e1 in igb_process_tx_desc qemu/hw/net/igb_core.c:671:17
|
||
|
|
#6 0x5575e659f3e1 in igb_start_xmit qemu/hw/net/igb_core.c:903:9
|
||
|
|
#7 0x5575e659f3e1 in igb_set_tdt qemu/hw/net/igb_core.c:2812:5
|
||
|
|
#8 0x5575e657d6a4 in igb_core_write qemu/hw/net/igb_core.c:4248:9
|
||
|
|
|
||
|
|
Fixes: CVE-2024-3567
|
||
|
|
Cc: qemu-stable@nongnu.org
|
||
|
|
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
|
||
|
|
Fixes: f199b13bc1 ("igb: Implement Tx SCTP CSO")
|
||
|
|
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2273
|
||
|
|
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
||
|
|
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
|
||
|
|
Acked-by: Jason Wang <jasowang@redhat.com>
|
||
|
|
Message-Id: <20240410070459.49112-1-philmd@linaro.org>
|
||
|
|
Signed-off-by: qihao_yewu <qihao_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
hw/net/net_tx_pkt.c | 4 ++++
|
||
|
|
1 file changed, 4 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c
|
||
|
|
index 2e5f58b3c9..d40d508a11 100644
|
||
|
|
--- a/hw/net/net_tx_pkt.c
|
||
|
|
+++ b/hw/net/net_tx_pkt.c
|
||
|
|
@@ -141,6 +141,10 @@ bool net_tx_pkt_update_sctp_checksum(struct NetTxPkt *pkt)
|
||
|
|
uint32_t csum = 0;
|
||
|
|
struct iovec *pl_start_frag = pkt->vec + NET_TX_PKT_PL_START_FRAG;
|
||
|
|
|
||
|
|
+ if (iov_size(pl_start_frag, pkt->payload_frags) < 8 + sizeof(csum)) {
|
||
|
|
+ return false;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
if (iov_from_buf(pl_start_frag, pkt->payload_frags, 8, &csum, sizeof(csum)) < sizeof(csum)) {
|
||
|
|
return false;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|