|
 |
f3149d8 |
From 3a15cc0e1ee7168db0782133d2607a6bfa422d66 Mon Sep 17 00:00:00 2001
|
|
|
f3149d8 |
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
|
f3149d8 |
Date: Fri, 8 Apr 2016 11:33:48 +0530
|
|
|
f3149d8 |
Subject: [PATCH] net: stellaris_enet: check packet length against receive buffer
|
|
|
f3149d8 |
|
|
|
f3149d8 |
When receiving packets over Stellaris ethernet controller, it
|
|
|
f3149d8 |
uses receive buffer of size 2048 bytes. In case the controller
|
|
|
f3149d8 |
accepts large(MTU) packets, it could lead to memory corruption.
|
|
|
f3149d8 |
Add check to avoid it.
|
|
|
f3149d8 |
|
|
|
f3149d8 |
Reported-by: Oleksandr Bazhaniuk <oleksandr.bazhaniuk@intel.com>
|
|
|
f3149d8 |
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
|
f3149d8 |
Message-id: 1460095428-22698-1-git-send-email-ppandit@redhat.com
|
|
|
f3149d8 |
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
|
|
|
f3149d8 |
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
|
|
|
f3149d8 |
---
|
|
|
f3149d8 |
tools/qemu-xen-traditional/hw/stellaris_enet.c | 12 +++++++++++-
|
|
|
f3149d8 |
1 files changed, 11 insertions(+), 1 deletions(-)
|
|
|
f3149d8 |
|
|
|
f3149d8 |
diff --git a/tools/qemu-xen-traditional/hw/stellaris_enet.c b/tools/qemu-xen-traditional/hw/stellaris_enet.c
|
|
|
f3149d8 |
index 84cf60b..6880894 100644
|
|
|
f3149d8 |
--- a/tools/qemu-xen-traditional/hw/stellaris_enet.c
|
|
|
f3149d8 |
+++ b/tools/qemu-xen-traditional/hw/stellaris_enet.c
|
|
|
f3149d8 |
@@ -236,8 +236,18 @@ static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, si
|
|
|
f3149d8 |
n = s->next_packet + s->np;
|
|
|
f3149d8 |
if (n >= 31)
|
|
|
f3149d8 |
n -= 31;
|
|
|
f3149d8 |
- s->np++;
|
|
|
f3149d8 |
|
|
|
f3149d8 |
+ if (size >= sizeof(s->rx[n].data) - 6) {
|
|
|
f3149d8 |
+ /* If the packet won't fit into the
|
|
|
f3149d8 |
+ * emulated 2K RAM, this is reported
|
|
|
f3149d8 |
+ * as a FIFO overrun error.
|
|
|
f3149d8 |
+ */
|
|
|
f3149d8 |
+ s->ris |= SE_INT_FOV;
|
|
|
f3149d8 |
+ stellaris_enet_update(s);
|
|
|
f3149d8 |
+ return -1;
|
|
|
f3149d8 |
+ }
|
|
|
f3149d8 |
+
|
|
|
f3149d8 |
+ s->np++;
|
|
|
f3149d8 |
s->rx[n].len = size + 6;
|
|
|
f3149d8 |
p = s->rx[n].data;
|
|
|
f3149d8 |
*(p++) = (size + 6);
|
|
|
f3149d8 |
--
|
|
|
f3149d8 |
1.7.0.4
|
|
|
f3149d8 |
|