[v6] net: tulip: add checks to avoid OOB access

[PATCH v6 0/2] net: tulip: add checks to avoid OOB access

P J P posted 2 patches 4 years, 1 month ago

Diff against v3 v4 v5
Download series mbox

Test docker-mingw@fedora passed

Test docker-quick@centos7 passed

Test checkpatch passed

Test FreeBSD passed

Test asan passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20200323122100.893417-1-ppandit@redhat.com

Maintainers: Sven Schnelle <svens@stackframe.org>, Jason Wang <jasowang@redhat.com>

hw/net/tulip.c | 51 +++++++++++++++++++++++++++++++++++++++++---------
1 file changed, 42 insertions(+), 9 deletions(-)

Expand all Fold all

[PATCH v6 0/2] net: tulip: add checks to avoid OOB access

Posted by P J P 4 years, 1 month ago

From: Prasad J Pandit <pjp@fedoraproject.org>

Hello,

* This series adds checks to avoid potential OOB access and infinite loop
  issues while processing rx/tx data.

* Tulip tx descriptors are capped at 128 to avoid infinite loop in
  tulip_xmit_list_update(), wrt Tulip kernel driver
  -> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/net/ethernet/dec/tulip/tulip.h#n319

* Update v3: add .can_receive routine
  -> https://lists.gnu.org/archive/html/qemu-devel/2020-02/msg06275.html

* Update v4: flush queued packets once they are received
  -> https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg05868.html

* Update v5: fixed a typo in patch commit message
  -> https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06209.html

* Update v6: merge earlier patch 2 & 3 into one
  -> https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06868.html

Thank you.
--
Prasad J Pandit (2):
  net: tulip: check frame size and r/w data length
  net: tulip: add .can_receive routine

 hw/net/tulip.c | 51 +++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 42 insertions(+), 9 deletions(-)

--
2.25.1