From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43316) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmOUq-0007OC-QH for qemu-devel@nongnu.org; Tue, 20 Sep 2016 13:06:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bmOUn-0007TP-O1 for qemu-devel@nongnu.org; Tue, 20 Sep 2016 13:06:15 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:37283 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmOUn-0007Sl-Ft for qemu-devel@nongnu.org; Tue, 20 Sep 2016 13:06:13 -0400 Received: from pps.filterd (m0098420.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u8KH3JE4003221 for ; Tue, 20 Sep 2016 13:06:13 -0400 Received: from e35.co.us.ibm.com (e35.co.us.ibm.com [32.97.110.153]) by mx0b-001b2d01.pphosted.com with ESMTP id 25jmr0xqf5-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Tue, 20 Sep 2016 13:06:12 -0400 Received: from localhost by e35.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 20 Sep 2016 11:06:12 -0600 From: Michael Roth Date: Tue, 20 Sep 2016 12:05:17 -0500 In-Reply-To: <1474391141-16623-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1474391141-16623-1-git-send-email-mdroth@linux.vnet.ibm.com> Message-Id: <1474391141-16623-2-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 01/25] net: check fragment length during fragmentation List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Prasad J Pandit , Jason Wang From: Prasad J Pandit Network transport abstraction layer supports packet fragmentation. While fragmenting a packet, it checks for more fragments from packet length and current fragment length. It is susceptible to an infinite loop, if the current fragment length is zero. Add check to avoid it. Reported-by: Li Qiang Signed-off-by: Prasad J Pandit Reviewed-by: Dmitry Fleytman CC: qemu-stable@nongnu.org Signed-off-by: Jason Wang (cherry picked from commit ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05) Signed-off-by: Michael Roth --- hw/net/vmxnet_tx_pkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/vmxnet_tx_pkt.c b/hw/net/vmxnet_tx_pkt.c index 91e1e08..f4d0f5f 100644 --- a/hw/net/vmxnet_tx_pkt.c +++ b/hw/net/vmxnet_tx_pkt.c @@ -544,7 +544,7 @@ static bool vmxnet_tx_pkt_do_sw_fragmentation(struct VmxnetTxPkt *pkt, fragment_offset += fragment_len; - } while (more_frags); + } while (fragment_len && more_frags); return true; } -- 1.9.1