[v4] net: tulip: add checks to avoid OOB access

[PATCH v4 0/3] net: tulip: add checks to avoid OOB access

P J P posted 3 patches 5 years, 7 months ago

Diff against v3 v5 v6
Download series mbox

Test docker-mingw@fedora passed

Test docker-quick@centos7 passed

Test checkpatch passed

Test FreeBSD passed

Test asan passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20200319095211.741445-1-ppandit@redhat.com

Maintainers: Jason Wang <jasowang@redhat.com>, Sven Schnelle <svens@stackframe.org>

There is a newer version of this series

hw/net/tulip.c | 51 +++++++++++++++++++++++++++++++++++++++++---------
1 file changed, 42 insertions(+), 9 deletions(-)

Expand all Fold all

[PATCH v4 0/3] net: tulip: add checks to avoid OOB access

Posted by P J P 5 years, 7 months ago

From: Prasad J Pandit <pjp@fedoraproject.org>

Hello,

* This series adds checks to avoid potential OOB access and infinite loop
  issues while processing rx/tx data.

* Tulip tx descriptors are capped at 128 to avoid infinite loop in
  tulip_xmit_list_update(), wrt Tulip kernel driver
  -> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/net/ethernet/dec/tulip/tulip.h#n319

* Update v3: add .can_receive routine
  -> https://lists.gnu.org/archive/html/qemu-devel/2020-02/msg06275.html

* Update v4: flush queued packets once they are received
  -> https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg05868.html

Thank you.
--
Prasad J Pandit (3):
  net: tulip: check frame size and r/w data length
  net: tulip: add .can_recieve routine
  net: tulip: flush queued packets post receive

 hw/net/tulip.c | 51 +++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 42 insertions(+), 9 deletions(-)

--
2.25.1