From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41823) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1apXCU-0001ux-Gh for qemu-devel@nongnu.org; Mon, 11 Apr 2016 04:28:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1apXCQ-0004hN-Fo for qemu-devel@nongnu.org; Mon, 11 Apr 2016 04:28:02 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34936) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1apXCQ-0004hG-Ag for qemu-devel@nongnu.org; Mon, 11 Apr 2016 04:27:58 -0400 References: <1460024762-14592-1-git-send-email-ppandit@redhat.com> <87r3ehwhia.fsf@dusky.pond.sub.org> From: Jason Wang Message-ID: <570B6008.6050609@redhat.com> Date: Mon, 11 Apr 2016 16:27:52 +0800 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] net: mipsnet: check packet length against buffer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: P J P , Markus Armbruster Cc: Oleksandr Bazhaniuk , Qemu Developers On 04/11/2016 03:37 PM, P J P wrote: > +-- On Thu, 7 Apr 2016, Markus Armbruster wrote --+ > | P J P writes: > | > | > --- a/hw/net/mipsnet.c > | > +++ b/hw/net/mipsnet.c > | > @@ -82,6 +82,9 @@ static ssize_t mipsnet_receive(NetClientState *nc, const uint8_t *buf, size_t si > | > if (!mipsnet_can_receive(nc)) > | > return 0; > | > > | > + if (size >= sizeof(s->rx_buffer)) { > | > + return 0; > | > + } > | > s->busy = 1; > | > | Prompted by Peter Maydell's review of the buddy patch to stellaris_enet: > | What does the physical device do when it receives such a packet? > > I tried to find a device specification, but couldn't find any reference > MIPSnet. > > Jason, wdyt? Can't find either. Looking at kernel driver git logs, the driver was even removed since 2012 because it was not longer supported by MIPS. Consider it indeed fixes a memory corruption, I tend to apply this first for 2.6. > -- > Prasad J Pandit / Red Hat Product Security Team > 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F >