[v2] hw/net: fix rx_desc_len on migration load

[PATCH v2 0/2] hw/net: fix rx_desc_len on migration load

Laurent Vivier posted 2 patches 2 days, 20 hours ago

Diff against v1
Download series mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260722112449.1386162-1-lvivier@redhat.com

Maintainers: Dmitry Fleytman <dmitry.fleytman@gmail.com>, Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>, Jason Wang <jasowangio@gmail.com>, Sriram Yagnaraman <sriram.yagnaraman@ericsson.com>

hw/net/e1000e_core.c | 18 +++++++++++++-----
hw/net/igb_core.c    |  2 ++
2 files changed, 15 insertions(+), 5 deletions(-)

Expand all Fold all

[PATCH v2 0/2] hw/net: fix rx_desc_len on migration load

Posted by Laurent Vivier 2 days, 20 hours ago

rx_desc_len is migrated as a raw uint8_t from the stream in both
e1000e and igb, but it is a derived value that can be computed from
the register state. A crafted migration stream can set rx_desc_len
to an invalid value, causing a stack buffer overflow in
e1000e_write_packet_to_guest() which copies rx_desc_len bytes into
a 32-byte stack union.

Recalculate rx_desc_len from the register state in post_load,
ignoring the untrusted value from the stream.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3869

v2:
  - extract e1000e_calc_rxconf() to recalculate all derived RX values
  - fix commit message to mention both RFCTL and RCTL
  - fix commit message to note that igb_rx_use_legacy_descriptor()
    is currently a stub

Laurent Vivier (2):
  hw/net/e1000e: recalculate rx_desc_len on migration load
  hw/net/igb: recalculate rx_desc_len on migration load

 hw/net/e1000e_core.c | 18 +++++++++++++-----
 hw/net/igb_core.c    |  2 ++
 2 files changed, 15 insertions(+), 5 deletions(-)

-- 
2.54.0

Re: [PATCH v2 0/2] hw/net: fix rx_desc_len on migration load

Posted by Akihiko Odaki 2 days, 2 hours ago

On 2026/07/22 20:24, Laurent Vivier wrote:
> rx_desc_len is migrated as a raw uint8_t from the stream in both
> e1000e and igb, but it is a derived value that can be computed from
> the register state. A crafted migration stream can set rx_desc_len
> to an invalid value, causing a stack buffer overflow in
> e1000e_write_packet_to_guest() which copies rx_desc_len bytes into
> a 32-byte stack union.
> 
> Recalculate rx_desc_len from the register state in post_load,
> ignoring the untrusted value from the stream.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3869>
> v2:
>    - extract e1000e_calc_rxconf() to recalculate all derived RX values
>    - fix commit message to mention both RFCTL and RCTL
>    - fix commit message to note that igb_rx_use_legacy_descriptor()
>      is currently a stub
> 
> Laurent Vivier (2):
>    hw/net/e1000e: recalculate rx_desc_len on migration load
>    hw/net/igb: recalculate rx_desc_len on migration load
> 
>   hw/net/e1000e_core.c | 18 +++++++++++++-----
>   hw/net/igb_core.c    |  2 ++
>   2 files changed, 15 insertions(+), 5 deletions(-)
> 

For the whole series,

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

Regards,
Akihiko Odaki