This patchset fixes a couple of bugs in the rtl8139 device related
to its handling of vlan tags.
The first is one that showed up as
https://gitlab.com/qemu-project/qemu/-/work_items/3518 -- a guest
can send a carefully constructed packet to itself over loopback
(or receive on over the network) that makes the vlan tag extraction
code overread the packet buffer by 4 bytes, leaking that data into
the guest. This is a regression that we introduced when we moved
"pad short packets" from individual network devices into the core
net code. Bin and I had a discussion about this:
https://lore.kernel.org/qemu-devel/CAFEAcA_UhmCxJc16CHE=4ZR1+PA0=4-29=fEe+d+iUmhLTzpuQ@mail.gmail.com/
where we started off thinking that we should fix this in the core
net code, but after looking at the 802.1Q spec I think that it is
a bug in the rtl8139 code, and it shouldn't be trying to pad the
packet as much as it is. So patch 1 fixes this by dropping that
attempt at padding entirely, so we always write exactly what we
get from the net backend into the receive buffer.
Patch 2 fixes a bug that Bin pointed out during that conversation:
when we insert a vlan tag while sending a packet over loopback we
don't adjust the size that we pass to qemu_receive_packet(), so we
truncate the last 4 bytes of data.
Big disclaimer here: I have tested these with "make check" and
with the buffer-overrun repro case from the bug report, and with
a simple guest VM. But we don't seem to document how to set up
a guest which receives and handles vlan-tagged packets, so I have
no idea how to actually test that part.
I don't think we need to be in a tearing hurry to get these fixes
into git, so although I've tagged them for stable I'm expecting
to get them in after we re-open for 11.2 rather than trying to
squeeze them into 11.1 at this point.
thanks
-- PMM
Peter Maydell (2):
hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets
hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback
hw/net/rtl8139.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--
2.43.0