From nobody Sun Feb 8 22:59:29 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1576816097; cv=none; d=zohomail.com; s=zohoarc; b=DCNL+Dc83/DZy0ofNQWPr/2XxdHrRYcET+zak+f6WWIUXoByya5Rrd5c1o4srvuKIHLgZr6eOK6KQpmXrZNxgnyw2xAgnj4UWXi1pJ/soGGics2vqwnxTuRmgZqrxKCPcDzWahCxe77FRss5o2KrbPSjjnxgKCYTVQej/e/HqR8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1576816097; h=Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:References:Sender:Subject:To; bh=VyBwerilwaxo4w0ACGa6WRdY60vz0dl9o5GW+XsPSJ4=; b=MDIR9RkTn1XT12lPeVI/cbC6wWYluxT3fxukquLC3A/Ur+XbfBnC/C2iahJBw1fM+evvNtEa2L9ueRZD05DwjrxfXoV/rOj793hBie4oIAzBkV7XsUcytkoK8HDx+Qvk6rW7huGQfcdKi1NzMxs4v7L4c3Shxr4eR6MdZ3gcdwI= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1576816097715493.69752179957663; Thu, 19 Dec 2019 20:28:17 -0800 (PST) Received: from localhost ([::1]:50584 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ii9tg-0001Nw-3v for importer@patchew.org; Thu, 19 Dec 2019 23:28:16 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:55813) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ii9ng-0008U3-NO for qemu-devel@nongnu.org; Thu, 19 Dec 2019 23:22:05 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ii9nf-00022P-8s for qemu-devel@nongnu.org; Thu, 19 Dec 2019 23:22:04 -0500 Received: from kvm5.telegraphics.com.au ([98.124.60.144]:34450) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ii9nf-00020I-09; Thu, 19 Dec 2019 23:22:03 -0500 Received: by kvm5.telegraphics.com.au (Postfix, from userid 502) id 409D628D32; Thu, 19 Dec 2019 23:22:02 -0500 (EST) To: Jason Wang , qemu-devel@nongnu.org Message-Id: <8f8d4dcf6323eb4fe8535914772053c0857f0e5e.1576815466.git.fthain@telegraphics.com.au> In-Reply-To: References: From: Finn Thain Subject: [PATCH v2 06/13] dp8393x: Implement packet size limit and RBAE interrupt Date: Fri, 20 Dec 2019 15:17:46 +1100 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 98.124.60.144 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Aleksandar Rikalo , =?UTF-8?q?Herv=C3=A9=20Poussineau?= , Laurent Vivier , qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Add a bounds check to prevent a large packet from causing a buffer overflow. This is defensive programming -- I haven't actually tried sending an oversized packet or a jumbo ethernet frame. The SONIC handles packets that are too big for the buffer by raising the RBAE interrupt and dropping them. Linux uses that interrupt to count dropped packets. Signed-off-by: Finn Thain --- Changed since v1: - Perform length check after Recieve Control Register initialization. --- hw/net/dp8393x.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c index 593853244d..9d2c205dce 100644 --- a/hw/net/dp8393x.c +++ b/hw/net/dp8393x.c @@ -137,6 +137,7 @@ do { printf("sonic ERROR: %s: " fmt, __func__ , ## __VA= _ARGS__); } while (0) #define SONIC_TCR_CRCI 0x2000 #define SONIC_TCR_PINT 0x8000 =20 +#define SONIC_ISR_RBAE 0x0010 #define SONIC_ISR_RBE 0x0020 #define SONIC_ISR_RDE 0x0040 #define SONIC_ISR_TC 0x0080 @@ -759,6 +760,14 @@ static ssize_t dp8393x_receive(NetClientState *nc, con= st uint8_t * buf, s->regs[SONIC_RCR] &=3D ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FA= ER | SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC); =20 + if (pkt_size + 4 > dp8393x_rbwc(s) * 2) { + DPRINTF("oversize packet, pkt_size is %d\n", pkt_size); + s->regs[SONIC_ISR] |=3D SONIC_ISR_RBAE; + dp8393x_update_irq(s); + dp8393x_do_read_rra(s); + return pkt_size; + } + packet_type =3D dp8393x_receive_filter(s, buf, pkt_size); if (packet_type < 0) { DPRINTF("packet not for netcard\n"); --=20 2.23.0