From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:58393) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TfOaB-0000ga-OO for qemu-devel@nongnu.org; Mon, 03 Dec 2012 00:28:44 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TfOaA-0007yR-Q2 for qemu-devel@nongnu.org; Mon, 03 Dec 2012 00:28:43 -0500 Received: from 70-88-178-169-atlanta.hfc.comcastbusiness.net ([70.88.178.169]:36759 helo=mail.inetric.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TfOaA-0007yH-Ij for qemu-devel@nongnu.org; Mon, 03 Dec 2012 00:28:42 -0500 From: Michael Contreras Date: Sun, 2 Dec 2012 20:11:22 -0800 Message-Id: <1354507882-21925-1-git-send-email-michael@inetric.com> Subject: [Qemu-devel] [PATCH] e1000: Discard packets that are too long if !SBP and !LPE List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Michael Contreras The e1000_receive function for the e1000 needs to discard packets longer than 1522 bytes if the SBP and LPE flags are disabled. The linux driver assumes this behavior and allocates memory based on this assumption. Signed-off-by: Michael Contreras --- Tested with linux guest. This error can potentially be exploited. At the very least it can cause a DoS to a guest system, and in the worse case it could allow remote code execution on the guest system with kernel level privilege. Risk seems low, as the network would need to be configured to allow large packets. hw/e1000.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/e1000.c b/hw/e1000.c index cb7e7e8..5537ad2 100644 --- a/hw/e1000.c +++ b/hw/e1000.c @@ -59,6 +59,9 @@ static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL); #define PNPMMIO_SIZE 0x20000 #define MIN_BUF_SIZE 60 /* Min. octets in an ethernet frame sans FCS */ +/* this is the size past which hardware will drop packets when setting LPE=0 */ +#define MAXIMUM_ETHERNET_VLAN_SIZE 1522 + /* * HW models: * E1000_DEV_ID_82540EM works with Windows and Linux @@ -805,6 +808,13 @@ e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size) size = sizeof(min_buf); } + /* Discard oversized packets if !LPE and !SBP. */ + if (size > MAXIMUM_ETHERNET_VLAN_SIZE + && !(s->mac_reg[RCTL] & E1000_RCTL_LPE) + && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) { + return size; + } + if (!receive_filter(s, buf, size)) return size; -- 1.7.11.7