From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:60663)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <aurelien@aurel32.net>) id 1bCNL9-0003WR-Cc
	for qemu-devel@nongnu.org; Mon, 13 Jun 2016 04:35:24 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <aurelien@aurel32.net>) id 1bCNL6-0004RI-Qk
	for qemu-devel@nongnu.org; Mon, 13 Jun 2016 04:35:22 -0400
Received: from hall.aurel32.net ([2001:bc8:30d7:100::1]:40268)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <aurelien@aurel32.net>) id 1bCNL6-0004RD-Kn
	for qemu-devel@nongnu.org; Mon, 13 Jun 2016 04:35:20 -0400
Date: Mon, 13 Jun 2016 10:35:17 +0200
From: Aurelien Jarno <aurelien@aurel32.net>
Message-ID: <20160613083517.GB16232@aurel32.net>
References: <1464849867-20184-1-git-send-email-ppandit@redhat.com>
	<CAFEAcA_a1nRknWwbu4SS2ehMp6o-4OgOQoTntRbSM5fSD3RVZw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAFEAcA_a1nRknWwbu4SS2ehMp6o-4OgOQoTntRbSM5fSD3RVZw@mail.gmail.com>
Subject: Re: [Qemu-devel] [PATCH] net: mipsnet: check transmit buffer size
 before sending
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Peter Maydell <peter.maydell@linaro.org>
Cc: P J P <ppandit@redhat.com>, Qemu Developers <qemu-devel@nongnu.org>, Jason Wang <jasowang@redhat.com>, Li Qiang <liqiang6-s@360.cn>, Prasad J Pandit <pjp@fedoraproject.org>, Leon Alrae <leon.alrae@imgtec.com>

On 2016-06-02 10:28, Peter Maydell wrote:
> On 2 June 2016 at 07:44, P J P <ppandit@redhat.com> wrote:
> > From: Prasad J Pandit <pjp@fedoraproject.org>
> >
> > When processing MIPSnet I/O port write operation, it uses a
> > transmit buffer tx_buffer[MAX_ETH_FRAME_SIZE=1514]. Two indices
> > 's->tx_written' and 's->tx_count' are used to control data written
> > to this buffer. If the two were to be equal before writing, it'd
> > lead to an OOB write access beyond tx_buffer. Add check to avoid it.
> >
> > Reported-by: Li Qiang <liqiang6-s@360.cn>
> > Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> > ---
> >  hw/net/mipsnet.c | 10 ++++++----
> >  1 file changed, 6 insertions(+), 4 deletions(-)
> >
> > diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
> > index 740cd98..8d5e5bf 100644
> > --- a/hw/net/mipsnet.c
> > +++ b/hw/net/mipsnet.c
> > @@ -158,7 +158,7 @@ static void mipsnet_ioport_write(void *opaque, hwaddr addr,
> >      trace_mipsnet_write(addr, val);
> >      switch (addr) {
> >      case MIPSNET_TX_DATA_COUNT:
> > -       s->tx_count = (val <= MAX_ETH_FRAME_SIZE) ? val : 0;
> > +        s->tx_count = (val < MAX_ETH_FRAME_SIZE) ? val : MAX_ETH_FRAME_SIZE;
> >          s->tx_written = 0;
> 
> This is a behaviour change -- the register will now read
> back as MAX_ETH_FRAME_SIZE rather than 0 if written with
> an overlarge value.
> 
> Do we have any documentation on how this (simulated)
> device is supposed to behave in this case?

This device is not supported by the linux kernel for more than 2.5 years
(since v3.7). Do we want to keep this device in QEMU? 

Aurelien

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net