| Message ID | 20210224054528.491866-1-jasowang@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | e1000: fail early for evil descriptor | expand |
On 2021/2/24 1:45 下午, Jason Wang wrote: > During procss_tx_desc(), driver can try to chain data descriptor with > legacy descriptor, when will lead underflow for the following > calculation in process_tx_desc() for bytes: > > if (tp->size + bytes > msh) > bytes = msh - tp->size; > > This will lead a infinite loop. So check and fail early if tp->size if > greater or equal to msh. > > Reported-by: Alexander Bulekov <alxndr@bu.edu> > Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> > Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de> > Cc: Prasad J Pandit <ppandit@redhat.com> > Signed-off-by: Jason Wang <jasowang@redhat.com> > --- > hw/net/e1000.c | 4 ++++ > 1 file changed, 4 insertions(+) Applied. Thanks > > diff --git a/hw/net/e1000.c b/hw/net/e1000.c > index d8da2f6528..4345d863e6 100644 > --- a/hw/net/e1000.c > +++ b/hw/net/e1000.c > @@ -670,6 +670,9 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) > msh = tp->tso_props.hdr_len + tp->tso_props.mss; > do { > bytes = split_size; > + if (tp->size >= msh) { > + goto eop; > + } > if (tp->size + bytes > msh) > bytes = msh - tp->size; > > @@ -695,6 +698,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) > tp->size += split_size; > } > > +eop: > if (!(txd_lower & E1000_TXD_CMD_EOP)) > return; > if (!(tp->cptse && tp->size < tp->tso_props.hdr_len)) {
diff --git a/hw/net/e1000.c b/hw/net/e1000.c index d8da2f6528..4345d863e6 100644 --- a/hw/net/e1000.c +++ b/hw/net/e1000.c @@ -670,6 +670,9 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) msh = tp->tso_props.hdr_len + tp->tso_props.mss; do { bytes = split_size; + if (tp->size >= msh) { + goto eop; + } if (tp->size + bytes > msh) bytes = msh - tp->size; @@ -695,6 +698,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp) tp->size += split_size; } +eop: if (!(txd_lower & E1000_TXD_CMD_EOP)) return; if (!(tp->cptse && tp->size < tp->tso_props.hdr_len)) {
During procss_tx_desc(), driver can try to chain data descriptor with legacy descriptor, when will lead underflow for the following calculation in process_tx_desc() for bytes: if (tp->size + bytes > msh) bytes = msh - tp->size; This will lead a infinite loop. So check and fail early if tp->size if greater or equal to msh. Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de> Cc: Prasad J Pandit <ppandit@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> --- hw/net/e1000.c | 4 ++++ 1 file changed, 4 insertions(+)