Skip to content

Fix possible OOB during queuing packets

Jason Wang qemu-devel 5 versions – Applied

Status from this message: Applied, thanks.

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v5 Latest5 patches 4 repliesApplied
  2. v44 patches 11 repliesSuperseded
  3. v34 patches 1 replySuperseded
Earlier versions · 2
VersionPostedPatchesRepliesStatus
v24 patches5 repliesSuperseded
v14 patches7 repliesSuperseded

Changes in v5 from the cover letter

- silent hub warning if qtest is enabled
- make qemu_deliver_packet_iov() static
- add one more test for packet size slightly greater than NET_BUFSIZE
- tweak the commit log and add more justification
- typo/whitespace fixes and other minor code style tweaks

Patches in v5 Applied

#Subject and filesSizeRepliesApplied
1/5net: drop too large packet earlyinclude/net/net.h net/net.c+17 -171 reply
2/5net: hub: suppress warnings of no host network for qtestnet/hub.c+2 -11 reply
3/5virtio-net-test: accept variable length argument in pci_test_start()tests/virtio-net-test.c+11 -60 replies
4/5virtio-net-test: remove unused macrotests/virtio-net-test.c+0 -10 replies
5/5virtio-net-test: add large tx buffer testtests/virtio-net-test.c+46 -01 reply

Reviews trailers per patch

All 5 patches have a Reviewed-by or Acked-by.

PatchLi QiangEric BlakeThomas Huth
1/5R-b R-b
2/5R-b
3/5R-b R-b
4/5R-b R-b
5/5R-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.

Read the v5 thread

Cover letter [Qemu-devel] [PATCH V5 for 3.1 0/5] Fix possible OOB during queuing packets

Hi:

This series tries to fix a possible OOB during queueing packets through qemu_net_queue_append_iov(). This could happen when it tries to queue a packet whose size is larger than INT_MAX which may lead integer overflow. We've fixed similar issue in the past during qemu_net_queue_deliver_iov() by ignoring large packets there. Let's just move the check earlier to qemu_sendv_packet_async() and reduce the limitation to NET_BUFSIZE. A simple qtest were also added this.

Please review.

Thanks

Changes from V1:
- slient compiling warnings
Changes from V2:
- annotate pci_test_start() with GCC_FMT_ATTR()
- drop intermediate cmd string variable
Changes from V4:
- silent hub warning if qtest is enabled
- make qemu_deliver_packet_iov() static
- add one more test for packet size slightly greater than NET_BUFSIZE
- tweak the commit log and add more justification
- typo/whitespace fixes and other minor code style tweaks

Jason Wang (5):
net: drop too large packet early
net: hub: suppress warnings of no host network for qtest
virtio-net-test: accept variable length argument in pci_test_start()
virtio-net-test: remove unused macro
virtio-net-test: add large tx buffer test

 include/net/net.h       |  6 ----
 net/hub.c               |  3 +-
 net/net.c               | 28 +++++++++++-------
 tests/virtio-net-test.c | 64 ++++++++++++++++++++++++++++++++++++-----
 4 files changed, 76 insertions(+), 25 deletions(-)
Signature · 1 line
2.17.1