c4dab45526
- qga/win32: Use rundll for VSS installation - qga/win32: Remove change action from MSI installer - ide: Increment BB in-flight counter for TRIM BH - hw/pci-bridge/pxb: Fix missing swizzle - host-vdpa: make notifiers _init()/_uninit() symmetric - hw/virtio: vdpa: Fix leak of host-notifier memory-region - accel/tcg/cpu-exec: Fix precise single-stepping after interrupt - Allow setting up to 8 bytes with the generic loader - hw/net/virtio-net: make some VirtIONet const - accel/tcg: Optimize jump cache flush during tlb range flush - 9pfs: prevent opening special files (CVE-2023-2861) - tcg: Reduce tcg_assert_listed_vecop() scope - gitlab: Disable plugins for cross-i386-tci - vfio/pci: Fix a segfault in vfio_realize - block/iscsi: fix double-free on BUSY or similar statuses - tests/tcg: fix unused variable in linux-test - hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value - qga/vss-win32: fix warning for clang++-15 - vnc: avoid underflow when accessing user-provided address - block/monitor: Fix crash when executing HMP commit - virtio-gpu: add a FIXME for virtio_gpu_load() - hw/ppc/Kconfig: MAC_NEWWORLD should always select USB_OHCI_PCI - migration: report compress thread pid to libvirt Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com>
48 lines
1.8 KiB
Diff
48 lines
1.8 KiB
Diff
From 2d7c5ea10b443c33ffe2c21de5a495bd6d2a67bd Mon Sep 17 00:00:00 2001
|
|
From: qihao <qihao_yewu@cmss.chinamobile.com>
|
|
Date: Wed, 28 Jun 2023 09:37:04 +0800
|
|
Subject: [PATCH] hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value
|
|
|
|
cheery-pick from b209cc4556d56938fa8a933670b8fb98c036af37
|
|
|
|
Currently, VMXNET3_MAX_MTU itself (being 9000) is not considered a
|
|
valid value for the MTU, but a guest running ESXi 7.0 might try to
|
|
set it and fail the assert [0].
|
|
|
|
In the Linux kernel, dev->max_mtu itself is a valid value for the MTU
|
|
and for the vmxnet3 driver it's 9000, so a guest running Linux will
|
|
also fail the assert when trying to set an MTU of 9000.
|
|
|
|
VMXNET3_MAX_MTU and s->mtu don't seem to be used in relation to buffer
|
|
allocations/accesses, so allowing the upper limit itself as a value
|
|
should be fine.
|
|
|
|
[0]: https://forum.proxmox.com/threads/114011/
|
|
|
|
Fixes: d05dcd94ae ("net: vmxnet3: validate configuration values during activate (CVE-2021-20203)")
|
|
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
|
|
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
|
(cherry picked from commit 099a63828130843741d317cb28e936f468b2b53b)
|
|
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
|
|
Signed-off-by: qihao_yewu <qihao_yewu@cmss.chinamobile.com>
|
|
---
|
|
hw/net/vmxnet3.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
|
|
index 0b7acf7f89..a2037583bf 100644
|
|
--- a/hw/net/vmxnet3.c
|
|
+++ b/hw/net/vmxnet3.c
|
|
@@ -1441,7 +1441,7 @@ static void vmxnet3_activate_device(VMXNET3State *s)
|
|
vmxnet3_setup_rx_filtering(s);
|
|
/* Cache fields from shared memory */
|
|
s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
|
|
- assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu < VMXNET3_MAX_MTU);
|
|
+ assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu <= VMXNET3_MAX_MTU);
|
|
VMW_CFPRN("MTU is %u", s->mtu);
|
|
|
|
s->max_rx_frags =
|
|
--
|
|
2.41.0.windows.1
|
|
|