rx_desc_len is migrated as a raw uint8_t from the stream in both
e1000e and igb, but it is a derived value that can be computed from
the register state. A crafted migration stream can set rx_desc_len
to an invalid value, causing a stack buffer overflow in
e1000e_write_packet_to_guest() which copies rx_desc_len bytes into
a 32-byte stack union.

Recalculate rx_desc_len from the register state in post_load,
ignoring the untrusted value from the stream.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3869

Laurent Vivier (2):
  hw/net/e1000e: recalculate rx_desc_len on migration load
  hw/net/igb: recalculate rx_desc_len on migration load

 hw/net/e1000e_core.c | 2 ++
 hw/net/igb_core.c    | 2 ++
 2 files changed, 4 insertions(+)

-- 
2.54.0

On 21/7/26 13:11, Laurent Vivier wrote:
> rx_desc_len is migrated as a raw uint8_t from the stream in both
> e1000e and igb, but it is a derived value that can be computed from
> the register state. A crafted migration stream can set rx_desc_len
> to an invalid value, causing a stack buffer overflow in
> e1000e_write_packet_to_guest() which copies rx_desc_len bytes into
> a 32-byte stack union.
> 
> Recalculate rx_desc_len from the register state in post_load,
> ignoring the untrusted value from the stream.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3869
> 
> Laurent Vivier (2):
>    hw/net/e1000e: recalculate rx_desc_len on migration load
>    hw/net/igb: recalculate rx_desc_len on migration load
> 
>   hw/net/e1000e_core.c | 2 ++
>   hw/net/igb_core.c    | 2 ++
>   2 files changed, 4 insertions(+)

Series:
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>