* [PATCH] virtio-net: Avoid indirection_table_mask overflow
@ 2024-10-08 6:51 Akihiko Odaki
2024-10-21 8:34 ` Jason Wang
0 siblings, 1 reply; 2+ messages in thread
From: Akihiko Odaki @ 2024-10-08 6:51 UTC (permalink / raw)
To: Michael S. Tsirkin, Jason Wang; +Cc: qemu-devel, Akihiko Odaki
We computes indirections_len by adding 1 to indirection_table_mask, but
it may overflow indirection_table_mask is UINT16_MAX. Check if
indirection_table_mask is small enough before adding 1.
Fixes: 590790297c0d ("virtio-net: implement RSS configuration command")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
---
hw/net/virtio-net.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 8f3097270869..625852a590ea 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1400,17 +1400,17 @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
n->rss_data.hash_types = virtio_ldl_p(vdev, &cfg.hash_types);
n->rss_data.indirections_len =
virtio_lduw_p(vdev, &cfg.indirection_table_mask);
- n->rss_data.indirections_len++;
if (!do_rss) {
- n->rss_data.indirections_len = 1;
+ n->rss_data.indirections_len = 0;
}
- if (!is_power_of_2(n->rss_data.indirections_len)) {
- err_msg = "Invalid size of indirection table";
+ if (n->rss_data.indirections_len >= VIRTIO_NET_RSS_MAX_TABLE_LEN) {
+ err_msg = "Too large indirection table";
err_value = n->rss_data.indirections_len;
goto error;
}
- if (n->rss_data.indirections_len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
- err_msg = "Too large indirection table";
+ n->rss_data.indirections_len++;
+ if (!is_power_of_2(n->rss_data.indirections_len)) {
+ err_msg = "Invalid size of indirection table";
err_value = n->rss_data.indirections_len;
goto error;
}
---
base-commit: 31669121a01a14732f57c49400bc239cf9fd505f
change-id: 20241008-mask-478ed6fe5365
Best regards,
--
Akihiko Odaki <akihiko.odaki@daynix.com>
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] virtio-net: Avoid indirection_table_mask overflow
2024-10-08 6:51 [PATCH] virtio-net: Avoid indirection_table_mask overflow Akihiko Odaki
@ 2024-10-21 8:34 ` Jason Wang
0 siblings, 0 replies; 2+ messages in thread
From: Jason Wang @ 2024-10-21 8:34 UTC (permalink / raw)
To: Akihiko Odaki; +Cc: Michael S. Tsirkin, qemu-devel
On Tue, Oct 8, 2024 at 2:51 PM Akihiko Odaki <akihiko.odaki@daynix.com> wrote:
>
> We computes indirections_len by adding 1 to indirection_table_mask, but
> it may overflow indirection_table_mask is UINT16_MAX. Check if
> indirection_table_mask is small enough before adding 1.
>
> Fixes: 590790297c0d ("virtio-net: implement RSS configuration command")
> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
> ---
> hw/net/virtio-net.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
Queued.
Thanks
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-10-21 8:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-08 6:51 [PATCH] virtio-net: Avoid indirection_table_mask overflow Akihiko Odaki
2024-10-21 8:34 ` Jason Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).