From nobody Sat May 18 22:15:03 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1543895812013553.2948211099907; Mon, 3 Dec 2018 19:56:52 -0800 (PST) Received: from localhost ([::1]:53876 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1pL-0008PC-1f for importer@patchew.org; Mon, 03 Dec 2018 22:56:51 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41250) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1n7-0006q9-VE for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:38 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gU1n5-0005gr-EZ for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:33 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50282) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gU1n4-0005TV-I3; Mon, 03 Dec 2018 22:54:31 -0500 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 1B9173082130; Tue, 4 Dec 2018 03:54:12 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-125.pek2.redhat.com [10.72.12.125]) by smtp.corp.redhat.com (Postfix) with ESMTP id D8A7B6013F; Tue, 4 Dec 2018 03:54:06 +0000 (UTC) From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Date: Tue, 4 Dec 2018 11:53:43 +0800 Message-Id: <20181204035347.6148-2-jasowang@redhat.com> In-Reply-To: <20181204035347.6148-1-jasowang@redhat.com> References: <20181204035347.6148-1-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.42]); Tue, 04 Dec 2018 03:54:12 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH V5 for 3.1 1/5] net: drop too large packet early X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: thuth@redhat.com, mst@redhat.com, liq3ea@163.com, Jason Wang , liq3ea@gmail.com, qemu-stable@nongnu.org, ppandit@redhat.com, pbonzini@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" We try to detect and drop too large packet (>INT_MAX) in 1592a9947036 ("net: ignore packet size greater than INT_MAX") during packet delivering. Unfortunately, this is not sufficient as we may hit another integer overflow when trying to queue such large packet in qemu_net_queue_append_iov(): - size of the allocation may overflow on 32bit - packet->size is integer which may overflow even on 64bit Fixing this by moving the check to qemu_sendv_packet_async() which is the entrance of all networking codes and reduce the limit to NET_BUFSIZE to be more conservative. This works since: - For the callers that call qemu_sendv_packet_async() directly, they only care about if zero is returned to determine whether to prevent the source from producing more packets. A callback will be triggered if peer can accept more then source could be enabled. This is usually used by high speed networking implementation like virtio-net or netmap. - For the callers that call qemu_sendv_packet() that calls qemu_sendv_packet_async() indirectly, they often ignore the return value. In this case qemu will just the drop packets if peer can't receive. Qemu will copy the packet if it was queued. So it was safe for both kinds of the callers to assume the packet was sent. Since we move the check from qemu_deliver_packet_iov() to qemu_sendv_packet_async(), it would be safer to make qemu_deliver_packet_iov() static to prevent any external user in the future. This is a revised patch of CVE-2018-17963. Cc: qemu-stable@nongnu.org Cc: Li Qiang Fixes: 1592a9947036 ("net: ignore packet size greater than INT_MAX") Reported-by: Li Qiang Reviewed-by: Li Qiang Signed-off-by: Jason Wang Reviewed-by: Thomas Huth --- include/net/net.h | 6 ------ net/net.c | 28 +++++++++++++++++----------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/include/net/net.h b/include/net/net.h index 7936d53d2f..ec13702dbf 100644 --- a/include/net/net.h +++ b/include/net/net.h @@ -169,12 +169,6 @@ void qemu_check_nic_model(NICInfo *nd, const char *mod= el); int qemu_find_nic_model(NICInfo *nd, const char * const *models, const char *default_model); =20 -ssize_t qemu_deliver_packet_iov(NetClientState *sender, - unsigned flags, - const struct iovec *iov, - int iovcnt, - void *opaque); - void print_net_client(Monitor *mon, NetClientState *nc); void hmp_info_network(Monitor *mon, const QDict *qdict); void net_socket_rs_init(SocketReadState *rs, diff --git a/net/net.c b/net/net.c index 07c194a8f6..1f7d626197 100644 --- a/net/net.c +++ b/net/net.c @@ -231,6 +231,11 @@ static void qemu_net_client_destructor(NetClientState = *nc) { g_free(nc); } +static ssize_t qemu_deliver_packet_iov(NetClientState *sender, + unsigned flags, + const struct iovec *iov, + int iovcnt, + void *opaque); =20 static void qemu_net_client_setup(NetClientState *nc, NetClientInfo *info, @@ -705,22 +710,18 @@ static ssize_t nc_sendv_compat(NetClientState *nc, co= nst struct iovec *iov, return ret; } =20 -ssize_t qemu_deliver_packet_iov(NetClientState *sender, - unsigned flags, - const struct iovec *iov, - int iovcnt, - void *opaque) +static ssize_t qemu_deliver_packet_iov(NetClientState *sender, + unsigned flags, + const struct iovec *iov, + int iovcnt, + void *opaque) { NetClientState *nc =3D opaque; - size_t size =3D iov_size(iov, iovcnt); int ret; =20 - if (size > INT_MAX) { - return size; - } =20 if (nc->link_down) { - return size; + return iov_size(iov, iovcnt); } =20 if (nc->receive_disabled) { @@ -745,10 +746,15 @@ ssize_t qemu_sendv_packet_async(NetClientState *sende= r, NetPacketSent *sent_cb) { NetQueue *queue; + size_t size =3D iov_size(iov, iovcnt); int ret; =20 + if (size > NET_BUFSIZE) { + return size; + } + if (sender->link_down || !sender->peer) { - return iov_size(iov, iovcnt); + return size; } =20 /* Let filters handle the packet first */ --=20 2.17.1 From nobody Sat May 18 22:15:03 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1543895811482337.15665133857544; Mon, 3 Dec 2018 19:56:51 -0800 (PST) Received: from localhost ([::1]:53877 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1pK-0008Pw-7M for importer@patchew.org; Mon, 03 Dec 2018 22:56:50 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41246) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1n7-0006q8-UO for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:38 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gU1n4-0005fp-RZ for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:33 -0500 Received: from mx1.redhat.com ([209.132.183.28]:43604) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gU1n3-0005Wv-Ss for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:30 -0500 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 67E56169751; Tue, 4 Dec 2018 03:54:16 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-125.pek2.redhat.com [10.72.12.125]) by smtp.corp.redhat.com (Postfix) with ESMTP id A5CBB601A6; Tue, 4 Dec 2018 03:54:12 +0000 (UTC) From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Date: Tue, 4 Dec 2018 11:53:44 +0800 Message-Id: <20181204035347.6148-3-jasowang@redhat.com> In-Reply-To: <20181204035347.6148-1-jasowang@redhat.com> References: <20181204035347.6148-1-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Tue, 04 Dec 2018 03:54:16 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH V5 for 3.1 2/5] net: hub: suppress warnings of no host network for qtest X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: thuth@redhat.com, mst@redhat.com, liq3ea@163.com, Jason Wang , liq3ea@gmail.com, ppandit@redhat.com, pbonzini@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" If we want to qtest through hub, it would be much more simpler and safer to configure the hub without host network. So silent this warnings for qtest. Signed-off-by: Jason Wang Reviewed-by: Thomas Huth --- net/hub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/hub.c b/net/hub.c index 78b671ed95..5795a678ed 100644 --- a/net/hub.c +++ b/net/hub.c @@ -20,6 +20,7 @@ #include "hub.h" #include "qemu/iov.h" #include "qemu/error-report.h" +#include "sysemu/qtest.h" =20 /* * A hub broadcasts incoming packets to all its ports except the source po= rt. @@ -346,7 +347,7 @@ void net_hub_check_clients(void) if (has_host_dev && !has_nic) { warn_report("hub %d with no nics", hub->id); } - if (has_nic && !has_host_dev) { + if (has_nic && !has_host_dev && !qtest_enabled()) { warn_report("hub %d is not connected to host network", hub->id= ); } } --=20 2.17.1 From nobody Sat May 18 22:15:03 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1543895938280619.5564804330872; Mon, 3 Dec 2018 19:58:58 -0800 (PST) Received: from localhost ([::1]:53888 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1rM-0001rL-Vg for importer@patchew.org; Mon, 03 Dec 2018 22:58:57 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41242) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1n7-0006q4-Ru for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:38 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gU1n4-0005fG-DM for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:33 -0500 Received: from mx1.redhat.com ([209.132.183.28]:37102) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gU1n3-0005ZP-SX for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:30 -0500 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id ACB29307CDFA; Tue, 4 Dec 2018 03:54:20 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-125.pek2.redhat.com [10.72.12.125]) by smtp.corp.redhat.com (Postfix) with ESMTP id E43686013F; Tue, 4 Dec 2018 03:54:16 +0000 (UTC) From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Date: Tue, 4 Dec 2018 11:53:45 +0800 Message-Id: <20181204035347.6148-4-jasowang@redhat.com> In-Reply-To: <20181204035347.6148-1-jasowang@redhat.com> References: <20181204035347.6148-1-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.49]); Tue, 04 Dec 2018 03:54:20 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH V5 for 3.1 3/5] virtio-net-test: accept variable length argument in pci_test_start() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: thuth@redhat.com, mst@redhat.com, liq3ea@163.com, Jason Wang , liq3ea@gmail.com, ppandit@redhat.com, pbonzini@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" This allows flexibility to be reused for all kinds of command line used by other tests. Reviewed-by: Eric Blake Reviewed-by: Thomas Huth Signed-off-by: Jason Wang --- tests/virtio-net-test.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/tests/virtio-net-test.c b/tests/virtio-net-test.c index dcb87a8b6e..587a043e67 100644 --- a/tests/virtio-net-test.c +++ b/tests/virtio-net-test.c @@ -52,17 +52,21 @@ static QVirtioPCIDevice *virtio_net_pci_init(QPCIBus *b= us, int slot) return dev; } =20 -static QOSState *pci_test_start(int socket) +GCC_FMT_ATTR(1, 2) +static QOSState *pci_test_start(const char *cmd, ...) { QOSState *qs; + va_list ap; const char *arch =3D qtest_get_arch(); - const char *cmd =3D "-netdev socket,fd=3D%d,id=3Dhs0 -device " - "virtio-net-pci,netdev=3Dhs0"; =20 if (strcmp(arch, "i386") =3D=3D 0 || strcmp(arch, "x86_64") =3D=3D 0) { - qs =3D qtest_pc_boot(cmd, socket); + va_start(ap, cmd); + qs =3D qtest_pc_vboot(cmd, ap); + va_end(ap); } else if (strcmp(arch, "ppc64") =3D=3D 0) { - qs =3D qtest_spapr_boot(cmd, socket); + va_start(ap, cmd); + qs =3D qtest_spapr_vboot(cmd, ap); + va_end(ap); } else { g_printerr("virtio-net tests are only available on x86 or ppc64\n"= ); exit(EXIT_FAILURE); @@ -223,7 +227,8 @@ static void pci_basic(gconstpointer data) ret =3D socketpair(PF_UNIX, SOCK_STREAM, 0, sv); g_assert_cmpint(ret, !=3D, -1); =20 - qs =3D pci_test_start(sv[1]); + qs =3D pci_test_start("-netdev socket,fd=3D%d,id=3Dhs0 -device " + "virtio-net-pci,netdev=3Dhs0", sv[1]); dev =3D virtio_net_pci_init(qs->pcibus, PCI_SLOT); =20 rx =3D (QVirtQueuePCI *)qvirtqueue_setup(&dev->vdev, qs->alloc, 0); --=20 2.17.1 From nobody Sat May 18 22:15:03 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1543895807240998.0020066645544; Mon, 3 Dec 2018 19:56:47 -0800 (PST) Received: from localhost ([::1]:53875 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1pG-0008NW-0k for importer@patchew.org; Mon, 03 Dec 2018 22:56:46 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41245) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1n7-0006q7-TM for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:38 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gU1n5-0005gY-8t for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:33 -0500 Received: from mx1.redhat.com ([209.132.183.28]:34728) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gU1n4-0005ed-DR for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:30 -0500 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 50CE981DE9; Tue, 4 Dec 2018 03:54:29 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-125.pek2.redhat.com [10.72.12.125]) by smtp.corp.redhat.com (Postfix) with ESMTP id 438916013C; Tue, 4 Dec 2018 03:54:20 +0000 (UTC) From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Date: Tue, 4 Dec 2018 11:53:46 +0800 Message-Id: <20181204035347.6148-5-jasowang@redhat.com> In-Reply-To: <20181204035347.6148-1-jasowang@redhat.com> References: <20181204035347.6148-1-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Tue, 04 Dec 2018 03:54:29 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH V5 for 3.1 4/5] virtio-net-test: remove unused macro X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: thuth@redhat.com, mst@redhat.com, liq3ea@163.com, Jason Wang , liq3ea@gmail.com, ppandit@redhat.com, pbonzini@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Reviewed-by: Thomas Huth Reviewed-by: Eric Blake Signed-off-by: Jason Wang --- tests/virtio-net-test.c | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/virtio-net-test.c b/tests/virtio-net-test.c index 587a043e67..bdd6af9999 100644 --- a/tests/virtio-net-test.c +++ b/tests/virtio-net-test.c @@ -24,7 +24,6 @@ =20 #define PCI_SLOT_HP 0x06 #define PCI_SLOT 0x04 -#define PCI_FN 0x00 =20 #define QVIRTIO_NET_TIMEOUT_US (30 * 1000 * 1000) #define VNET_HDR_SIZE sizeof(struct virtio_net_hdr_mrg_rxbuf) --=20 2.17.1 From nobody Sat May 18 22:15:03 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1543895968463482.58046457208206; Mon, 3 Dec 2018 19:59:28 -0800 (PST) Received: from localhost ([::1]:53889 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1rr-0002EA-Bz for importer@patchew.org; Mon, 03 Dec 2018 22:59:27 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41371) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gU1nD-0006s0-Kh for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:42 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gU1nC-0005qo-43 for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:39 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50392) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gU1nB-0005oU-IT for qemu-devel@nongnu.org; Mon, 03 Dec 2018 22:54:37 -0500 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 758E0308213A; Tue, 4 Dec 2018 03:54:36 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-125.pek2.redhat.com [10.72.12.125]) by smtp.corp.redhat.com (Postfix) with ESMTP id C8AF96013C; Tue, 4 Dec 2018 03:54:29 +0000 (UTC) From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Date: Tue, 4 Dec 2018 11:53:47 +0800 Message-Id: <20181204035347.6148-6-jasowang@redhat.com> In-Reply-To: <20181204035347.6148-1-jasowang@redhat.com> References: <20181204035347.6148-1-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.42]); Tue, 04 Dec 2018 03:54:36 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH V5 for 3.1 5/5] virtio-net-test: add large tx buffer test X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: thuth@redhat.com, mst@redhat.com, liq3ea@163.com, Jason Wang , liq3ea@gmail.com, ppandit@redhat.com, pbonzini@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" This test tries to build a packet whose size is greater than INT_MAX which tries to trigger integer overflow in qemu_net_queue_append_iov() which may result OOB. Signed-off-by: Jason Wang Reviewed-by: Thomas Huth --- tests/virtio-net-test.c | 46 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/tests/virtio-net-test.c b/tests/virtio-net-test.c index bdd6af9999..e9783e6707 100644 --- a/tests/virtio-net-test.c +++ b/tests/virtio-net-test.c @@ -245,6 +245,48 @@ static void pci_basic(gconstpointer data) g_free(dev); qtest_shutdown(qs); } + +static void large_tx(gconstpointer data) +{ + QVirtioPCIDevice *dev; + QOSState *qs; + QVirtQueuePCI *tx, *rx; + QVirtQueue *vq; + uint64_t req_addr; + uint32_t free_head; + size_t alloc_size =3D (size_t)data / 64; + int i; + + qs =3D pci_test_start("-netdev hubport,id=3Dhp0,hubid=3D0 " + "-device virtio-net-pci,netdev=3Dhp0"); + dev =3D virtio_net_pci_init(qs->pcibus, PCI_SLOT); + + rx =3D (QVirtQueuePCI *)qvirtqueue_setup(&dev->vdev, qs->alloc, 0); + tx =3D (QVirtQueuePCI *)qvirtqueue_setup(&dev->vdev, qs->alloc, 1); + + driver_init(&dev->vdev); + vq =3D &tx->vq; + + /* Bypass the limitation by pointing several descriptors to a single + * smaller area */ + req_addr =3D guest_alloc(qs->alloc, alloc_size); + free_head =3D qvirtqueue_add(vq, req_addr, alloc_size, false, true); + + for (i =3D 0; i < 64; i++) { + qvirtqueue_add(vq, req_addr, alloc_size, false, i !=3D 63); + } + qvirtqueue_kick(&dev->vdev, vq, free_head); + + qvirtio_wait_used_elem(&dev->vdev, vq, free_head, NULL, + QVIRTIO_NET_TIMEOUT_US); + + qvirtqueue_cleanup(dev->vdev.bus, &tx->vq, qs->alloc); + qvirtqueue_cleanup(dev->vdev.bus, &rx->vq, qs->alloc); + qvirtio_pci_device_disable(dev); + g_free(dev->pdev); + g_free(dev); + qtest_shutdown(qs); +} #endif =20 static void hotplug(void) @@ -270,6 +312,10 @@ int main(int argc, char **argv) qtest_add_data_func("/virtio/net/pci/basic", send_recv_test, pci_basic= ); qtest_add_data_func("/virtio/net/pci/rx_stop_cont", stop_cont_test, pci_basic); + qtest_add_data_func("/virtio/net/pci/large_tx_uint_max", + (gconstpointer)UINT_MAX, large_tx); + qtest_add_data_func("/virtio/net/pci/large_tx_net_bufsize", + (gconstpointer)NET_BUFSIZE, large_tx); #endif qtest_add_func("/virtio/net/pci/hotplug", hotplug); =20 --=20 2.17.1