From nobody Wed May 15 22:20:14 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1681406578; cv=none; d=zohomail.com; s=zohoarc; b=Gx3c4aW9aNU0Btr947mcXghoXSHmDkVitZT7MN8Qyc3TQ1+Hwf+GiWVo2c5NA0IP5AUym140kwAcoOUhu/GgSNLY9kJUT89D4/z5ul/5UoVE75I9gPrbWpoF8/w022pDqBi10b2LzxlMUC6kZfAd7zAcFuYWpeTweezqoQE6wJo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1681406578; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=WoTR/eqzUD2JElMdId6U3MF9cQSmNXlCOb4CgYSr3Rk=; b=Y/dvItUZuVAbMfhS9ZoNnBOTL9mi5WUmLyjcxTcO4Y1TZCIhliLBK8lfYlf4hhg21OF6nOKj95n2OqfXQTqh+xrbXxgRA4aYzYe3nCFOwdpRzVby+MXbMSmA8yIXpPfqwnQXBxgxqMA3juJh+CYMf3WIlhDNAASDIy5p0yAZ5P4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1681406578681960.6495791020159; Thu, 13 Apr 2023 10:22:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1pn0dZ-0003CR-6z; Thu, 13 Apr 2023 13:21:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pn0dX-0003CI-SL for qemu-devel@nongnu.org; Thu, 13 Apr 2023 13:21:32 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1pn0d9-0001dZ-R7 for qemu-devel@nongnu.org; Thu, 13 Apr 2023 13:21:31 -0400 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-41-z4O1COBbPyWXwZq4mwwyBA-1; Thu, 13 Apr 2023 13:21:03 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 46E2585542A; Thu, 13 Apr 2023 17:21:01 +0000 (UTC) Received: from localhost (unknown [10.39.192.23]) by smtp.corp.redhat.com (Postfix) with ESMTP id CF96540C6E70; Thu, 13 Apr 2023 17:21:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1681406466; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=WoTR/eqzUD2JElMdId6U3MF9cQSmNXlCOb4CgYSr3Rk=; b=VOvWQiOWW0ARNAKZCYoJeJcTB2CQAFfGoWC6xESzRBAzyqyD2wJlRku8wkWRSCl7cB6LKB tXXB4DNEtE+WoEcNtkxwFYdnXBMYStG4w2/Hoi2soxiNV4Klous3LA5GDLSqVVB+92GQHi VSNOTzNYthWJxXsVUOCkC41wU2vUbHU= X-MC-Unique: z4O1COBbPyWXwZq4mwwyBA-1 From: Stefan Hajnoczi To: qemu-devel@nongnu.org Cc: Jason Wang , Stefan Hajnoczi , Alexander Bulekov , Peter Maydell Subject: [PATCH] rtl8139: fix large_send_mss divide-by-zero Date: Thu, 13 Apr 2023 13:19:46 -0400 Message-Id: <20230413171946.2865726-1-stefanha@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=stefanha@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1681406579492100001 Content-Type: text/plain; charset="utf-8" If the driver sets large_send_mss to 0 then a divide-by-zero occurs. Even if the division wasn't a problem, the for loop that emits MSS-sized packets would never terminate. Solve these issues by skipping offloading when large_send_mss=3D0. This issue was found by OSS-Fuzz as part of Alexander Bulekov's device fuzzing work. The reproducer is: $ cat << EOF | ./qemu-system-i386 -display none -machine accel=3Dqtest, -= m \ 512M,slots=3D1,maxmem=3D0xffff000000000000 -machine q35 -nodefaults -devi= ce \ rtl8139,netdev=3Dnet0 -netdev user,id=3Dnet0 -device \ pc-dimm,id=3Dnv1,memdev=3Dmem1,addr=3D0xb800a64602800000 -object \ memory-backend-ram,id=3Dmem1,size=3D2M -qtest stdio outl 0xcf8 0x80000814 outl 0xcfc 0xe0000000 outl 0xcf8 0x80000804 outw 0xcfc 0x06 write 0xe0000037 0x1 0x04 write 0xe00000e0 0x2 0x01 write 0x1 0x1 0x04 write 0x3 0x1 0x98 write 0xa 0x1 0x8c write 0xb 0x1 0x02 write 0xc 0x1 0x46 write 0xd 0x1 0xa6 write 0xf 0x1 0xb8 write 0xb800a646028c000c 0x1 0x08 write 0xb800a646028c000e 0x1 0x47 write 0xb800a646028c0010 0x1 0x02 write 0xb800a646028c0017 0x1 0x06 write 0xb800a646028c0036 0x1 0x80 write 0xe00000d9 0x1 0x40 EOF Buglink: https://gitlab.com/qemu-project/qemu/-/issues/1582 Fixes: 6d71357a3b65 ("rtl8139: honor large send MSS value") Reported-by: Alexander Bulekov Cc: Peter Maydell Signed-off-by: Stefan Hajnoczi Acked-by: Jason Wang Reviewed-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daud=C3=A9 Tested-by: Alexander Bulekov --- hw/net/rtl8139.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c index 5a5aaf868d..5f1a4d359b 100644 --- a/hw/net/rtl8139.c +++ b/hw/net/rtl8139.c @@ -2154,6 +2154,9 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) =20 int large_send_mss =3D (txdw0 >> CP_TC_LGSEN_MSS_SHIFT) & CP_TC_LGSEN_MSS_MASK; + if (large_send_mss =3D=3D 0) { + goto skip_offload; + } =20 DPRINTF("+++ C+ mode offloaded task TSO IP data %d " "frame data %d specified MSS=3D%d\n", --=20 2.39.2