From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48691) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZoOku-0007dw-CS for qemu-devel@nongnu.org; Tue, 20 Oct 2015 00:42:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZoOkr-0006Ea-6n for qemu-devel@nongnu.org; Tue, 20 Oct 2015 00:42:36 -0400 Received: from mx1.redhat.com ([209.132.183.28]:54671) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZoOkr-0006E6-1X for qemu-devel@nongnu.org; Tue, 20 Oct 2015 00:42:33 -0400 References: <1444906470-21216-1-git-send-email-dana.rubin@ravellosystems.com> From: Jason Wang Message-ID: <5625C632.20802@redhat.com> Date: Tue, 20 Oct 2015 12:42:26 +0800 MIME-Version: 1.0 In-Reply-To: <1444906470-21216-1-git-send-email-dana.rubin@ravellosystems.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] vmxnet3: Do not fill stats if device is inactive List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Dana Rubin , Dmitry Fleytman Cc: Leonid Shatz , Idan Brown , Dana Rubin , qemu-devel@nongnu.org On 10/15/2015 06:54 PM, Dana Rubin wrote: > From: Shmulik Ladkani > > Guest OS may issue VMXNET3_CMD_GET_STATS even before device was > activated (for example in linux, after insmod but prior net-dev open). > > Accessing shared descriptors prior device activation is illegal as the > VMXNET3State structures have not been fully initialized. > > As a result, guest memory gets corrupted and may lead to guest OS > crashes. > > Fix, by not filling the stats descriptors if device is inactive. > > Reported-by: Leonid Shatz > Signed-off-by: Dana Rubin > Signed-off-by: Shmulik Ladkani > --- > hw/net/vmxnet3.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c > index 3c5e10d..5e3a233 100644 > --- a/hw/net/vmxnet3.c > +++ b/hw/net/vmxnet3.c > @@ -1289,6 +1289,10 @@ static uint32_t vmxnet3_get_interrupt_config(VMXNET3State *s) > static void vmxnet3_fill_stats(VMXNET3State *s) > { > int i; > + > + if (!s->device_active) > + return; > + > for (i = 0; i < s->txq_num; i++) { > cpu_physical_memory_write(s->txq_descr[i].tx_stats_pa, > &s->txq_descr[i].txq_stats, Applied in https://github.com/jasowang/qemu/commits/net Thanks