From nobody Fri May 3 04:33:21 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1594372926; cv=none; d=zohomail.com; s=zohoarc; b=dHxEVITILdZTN/WH6liJ8a7V9sa/5fwobiMVFBOsIrl9+2PUeQ4a83e4Picq2SHn4htNV7VIQOE0+F8j9pXDNB2Bx0TMo50BAUIaSZNm8PEbVkAUuqxl/oumU6G8tJFDzQd6PrS8DwcRFB2CkNd1YOoHsLP5yKI06mKw3O+8uiI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1594372926; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=bRh1CyXwAmDj04p/JeBnKfYqsXVQ4dytq9QvwnTG3/g=; b=Bav9MHobGdxpapPymne5OnyNDREvQBpgEIutvr10c0MR8h5rOeoOsvmvQE4AmC2hdrst623dTEfe6+TSJddU5B1oN0KpMyIdIMjy7Wp+4k/SWtWsIiAuq9Uq+IUx4K+2a1L8HiPF4p0Jpx60wrepOvsSktgchihTBi88lbqFtbU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 15943729260960.4828855122062805; Fri, 10 Jul 2020 02:22:06 -0700 (PDT) Received: from localhost ([::1]:54116 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jtpEK-0001yi-QV for importer@patchew.org; Fri, 10 Jul 2020 05:22:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:44730) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jtpDE-0000xU-3v for qemu-devel@nongnu.org; Fri, 10 Jul 2020 05:20:56 -0400 Received: from us-smtp-delivery-1.mimecast.com ([205.139.110.120]:60221 helo=us-smtp-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1jtpDB-0003b2-MO for qemu-devel@nongnu.org; Fri, 10 Jul 2020 05:20:55 -0400 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-242-JVDeHd0wOMWe_4ylTSyYCQ-1; Fri, 10 Jul 2020 05:20:50 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id ADDD61B2C981; Fri, 10 Jul 2020 09:20:49 +0000 (UTC) Received: from fedora.redhat.com (unknown [10.40.193.187]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 03B3B7EF93; Fri, 10 Jul 2020 09:20:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1594372852; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bRh1CyXwAmDj04p/JeBnKfYqsXVQ4dytq9QvwnTG3/g=; b=YROEE9A8KxdINa1aMrUavN2wvRNLnQYqvqyBLRJmmuMI866tUwwwXmHEcgABjG5HQeLp3y kJeuSBU/1f8MWAQjCN4IuMWL9NbBxJuaLfvgJEShy7NlDI37qIQj6e7kc2/9wD1Vs5Ljw8 NqQJFDj6mpAKogfslXYrM7MiUUmHBh8= X-MC-Unique: JVDeHd0wOMWe_4ylTSyYCQ-1 From: Mauro Matteo Cascella To: qemu-devel@nongnu.org Subject: [PATCH] hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() Date: Fri, 10 Jul 2020 11:19:41 +0200 Message-Id: <20200710091940.641296-1-mcascell@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=205.139.110.120; envelope-from=mcascell@redhat.com; helo=us-smtp-1.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/10 04:36:30 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -40 X-Spam_score: -4.1 X-Spam_bar: ---- X-Spam_report: (-4.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: robh@kernel.org, Mauro Matteo Cascella , peter.maydell@linaro.org, jasowang@redhat.com, qemu-arm@nongnu.org, ezrakiez@gmail.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" A buffer overflow issue was reported by Mr. Ziming Zhang, CC'd here. It occurs while sending an Ethernet frame due to missing break statements and improper checking of the buffer size. Reported-by: Ziming Zhang Signed-off-by: Mauro Matteo Cascella Reviewed-by: Peter Maydell --- hw/net/xgmac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/hw/net/xgmac.c b/hw/net/xgmac.c index 574dd47b41..b872afbb1a 100644 --- a/hw/net/xgmac.c +++ b/hw/net/xgmac.c @@ -224,17 +224,20 @@ static void xgmac_enet_send(XgmacState *s) DEBUGF_BRK("qemu:%s:ERROR...ERROR...ERROR... -- " "xgmac buffer 1 len on send > 2048 (0x%x)\n", __func__, bd.buffer1_size & 0xfff); + break; } if ((bd.buffer2_size & 0xfff) !=3D 0) { DEBUGF_BRK("qemu:%s:ERROR...ERROR...ERROR... -- " "xgmac buffer 2 len on send !=3D 0 (0x%x)\n", __func__, bd.buffer2_size & 0xfff); + break; } - if (len >=3D sizeof(frame)) { + if (frame_size + len >=3D sizeof(frame)) { DEBUGF_BRK("qemu:%s: buffer overflow %d read into %zu " - "buffer\n" , __func__, len, sizeof(frame)); + "buffer\n" , __func__, frame_size + len, sizeof(fr= ame)); DEBUGF_BRK("qemu:%s: buffer1.size=3D%d; buffer2.size=3D%d\n", __func__, bd.buffer1_size, bd.buffer2_size); + break; } =20 cpu_physical_memory_read(bd.buffer1_addr, ptr, len); --=20 2.26.2