Re: [PATCH 1/3] hw/net/smc91c111: Sanitize packet numbers

["Philippe Mathieu-Daudé" <philmd@linaro.org>]

On 28/2/25 18:47, Peter Maydell wrote:
> The smc91c111 uses packet numbers as an index into its internal
> s->data[][] array. Valid packet numbers are between 0 and 3, but
> the code does not generally check this, and there are various
> places where the guest can hand us an arbitrary packet number
> and cause an out-of-bounds access to the data array.
> 
> Add validation of packet numbers. The datasheet is not very
> helpful about how guest errors like this should be handled:
> it says nothing on the subject, and none of the documented
> error conditions are relevant. We choose to log the situation
> with LOG_GUEST_ERROR and silently ignore the attempted operation.
> 
> In the places where we are about to access the data[][] array
> using a packet number and we know the number is valid because
> we got it from somewhere that has already validated, we add
> an assert() to document that belief.
> 
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>   hw/net/smc91c111.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
>   1 file changed, 45 insertions(+)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>