Re: [Qemu-devel] [PATCH] net: rocker: fix an incorrect array bounds check

[Jiri Pirko <jiri@resnulli.us>]

Tue, Dec 22, 2015 at 02:07:01PM CET, ppandit@redhat.com wrote:
>  Hello Scott, Jiri
>
>A stack overflow issue was reported by Mr Qinghao Tang, CC'd here. It occurs
>while processing transmit(tx) descriptors in tx_consume() routine. If a
>descriptor was to have more than allowed(ROCKER_TX_FRAGS_MAX=16) packet
>fragments, the processing loop suffers an off-by-one error. Thus leading to
>OOB memory access and leakage of host memory.
>
>Please see below a proposed patch to fix this issue. Does it look okay?
>
>===
>From f3461d8098a0572786f5a2d7a492863090c73134 Mon Sep 17 00:00:00 2001
>From: Prasad J Pandit <pjp@fedoraproject.org>
>Date: Tue, 22 Dec 2015 18:21:00 +0530
>Subject: [PATCH] net: rocker: fix an incorrect array bounds check
>
>While processing transmit(tx) descriptors in 'tx_consume' routine
>the switch emulator suffers from an off-by-one error, if a
>descriptor was to have more than allowed(ROCKER_TX_FRAGS_MAX)
>fragments. Fix an incorrect bounds check to avoid it.
>
>Reported-by: Qinghao Tang <luodalongde@gmail.com>
>Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>

Reviewed-by: Jiri Pirko <jiri@mellanox.com>