From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52099) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZoNI9-00055r-LP for qemu-devel@nongnu.org; Mon, 19 Oct 2015 23:08:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZoNHl-0006nT-2s for qemu-devel@nongnu.org; Mon, 19 Oct 2015 23:08:28 -0400 Received: from mx1.redhat.com ([209.132.183.28]:49120) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZoNHk-0006nN-TL for qemu-devel@nongnu.org; Mon, 19 Oct 2015 23:08:25 -0400 References: <1444906470-21216-1-git-send-email-dana.rubin@ravellosystems.com> <18791EE9-6D20-498A-B67E-6211A9DFF542@daynix.com> From: Jason Wang Message-ID: <5625B021.7070208@redhat.com> Date: Tue, 20 Oct 2015 11:08:17 +0800 MIME-Version: 1.0 In-Reply-To: <18791EE9-6D20-498A-B67E-6211A9DFF542@daynix.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] vmxnet3: Do not fill stats if device is inactive List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Dmitry Fleytman , Dana Rubin Cc: Leonid Shatz , Idan Brown , qemu-devel@nongnu.org, Dana Rubin On 10/18/2015 03:16 PM, Dmitry Fleytman wrote: > ACK Hi Dmitry: Thanks a lot for the reviewing. As I want to add your "Acked-by" in the patch, could you pls add a formal one in the future? (Which can make my life a little bit easier). >> On 15 Oct 2015, at 13:54 PM, Dana Rubin wrote: >> >> From: Shmulik Ladkani >> >> Guest OS may issue VMXNET3_CMD_GET_STATS even before device was >> activated (for example in linux, after insmod but prior net-dev open). >> >> Accessing shared descriptors prior device activation is illegal as the >> VMXNET3State structures have not been fully initialized. >> >> As a result, guest memory gets corrupted and may lead to guest OS >> crashes. >> >> Fix, by not filling the stats descriptors if device is inactive. >> >> Reported-by: Leonid Shatz >> Signed-off-by: Dana Rubin >> Signed-off-by: Shmulik Ladkani >> --- >> hw/net/vmxnet3.c | 4 ++++ >> 1 file changed, 4 insertions(+) >> >> diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c >> index 3c5e10d..5e3a233 100644 >> --- a/hw/net/vmxnet3.c >> +++ b/hw/net/vmxnet3.c >> @@ -1289,6 +1289,10 @@ static uint32_t vmxnet3_get_interrupt_config(VMXNET3State *s) >> static void vmxnet3_fill_stats(VMXNET3State *s) >> { >> int i; >> + >> + if (!s->device_active) >> + return; >> + >> for (i = 0; i < s->txq_num; i++) { >> cpu_physical_memory_write(s->txq_descr[i].tx_stats_pa, >> &s->txq_descr[i].txq_stats, >> -- >> 1.9.1 >> >