Re: [Qemu-devel] [PATCH v2] net: rocker: fix an incorrect array bounds check

[Stefan Hajnoczi <stefanha@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2111 bytes --]

On Wed, Dec 23, 2015 at 12:54:18AM +0530, P J P wrote:
>   Hello Paolo, all
> 
> Please see an updated patch below, as per suggestion in
>   -> https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04057.html

Adding Jason Wang (net maintainer) on CC.

> ===
> >From 344a487d637be20b3fb110bec36cb703e7f6ecaa Mon Sep 17 00:00:00 2001
> From: Prasad J Pandit <pjp@fedoraproject.org>
> Date: Wed, 23 Dec 2015 00:40:13 +0530
> Subject: [PATCH v2] net: rocker: fix an incorrect array bounds check
> 
> While processing transmit(tx) descriptors in 'tx_consume' routine
> the switch emulator suffers from an off-by-one error, if a
> descriptor was to have more than allowed(ROCKER_TX_FRAGS_MAX=16)
> fragments. Fix an incorrect bounds check to avoid it.
> 
> Reported-by: Qinghao Tang <luodalongde@gmail.com>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
>  hw/net/rocker/rocker.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/net/rocker/rocker.c b/hw/net/rocker/rocker.c
> index c57f1a6..2e77e50 100644
> --- a/hw/net/rocker/rocker.c
> +++ b/hw/net/rocker/rocker.c
> @@ -232,6 +232,9 @@ static int tx_consume(Rocker *r, DescInfo *info)
>          frag_addr = rocker_tlv_get_le64(tlvs[ROCKER_TLV_TX_FRAG_ATTR_ADDR]);
>          frag_len = rocker_tlv_get_le16(tlvs[ROCKER_TLV_TX_FRAG_ATTR_LEN]);
> 
> +        if (iovcnt >= ROCKER_TX_FRAGS_MAX) {
> +            goto err_too_many_frags;
> +        }
>          iov[iovcnt].iov_len = frag_len;
>          iov[iovcnt].iov_base = g_malloc(frag_len);
>          if (!iov[iovcnt].iov_base) {
> @@ -244,10 +247,7 @@ static int tx_consume(Rocker *r, DescInfo *info)
>              err = -ROCKER_ENXIO;
>              goto err_bad_io;
>          }
> -
> -        if (++iovcnt > ROCKER_TX_FRAGS_MAX) {
> -            goto err_too_many_frags;
> -        }
> +        iovcnt++;
>      }
> 
>      if (iovcnt) {
> -- 
> 2.4.3
> ===
> 
> 
> Thank you.
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 473 bytes --]