Re: [Qemu-devel] [PATCH] net: mipsnet: check packet length against buffer

[Jason Wang <jasowang@redhat.com>]

On 04/07/2016 06:26 PM, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> When receiving packets over MIPSnet network device, it uses
>  receive buffer of size 1514 bytes. In case the controller
> accepts large(MTU) packets, it could lead to memory corruption.
> Add check to avoid it.
>
> Reported by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com>
>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
>  hw/net/mipsnet.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
> index f261011..e134b31 100644
> --- a/hw/net/mipsnet.c
> +++ b/hw/net/mipsnet.c
> @@ -82,6 +82,9 @@ static ssize_t mipsnet_receive(NetClientState *nc, const uint8_t *buf, size_t si
>      if (!mipsnet_can_receive(nc))
>          return 0;
>  
> +    if (size >= sizeof(s->rx_buffer)) {
> +        return 0;
> +    }
>      s->busy = 1;
>  
>      /* Just accept everything. */

Apply to net-next.

Thanks