diff options
| author | Thomas Huth <thuth@redhat.com> | 2023-08-17 14:56:00 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2023-09-08 13:08:52 +0300 |
| commit | 90a0778421acdf4ca903be64c8ed19378183c944 (patch) | |
| tree | 7da6cdd63d5c962145d73df2869a714eedbd3411 /hw/net/vmxnet3.c | |
| parent | 0084f6834a13aedaf4375fa34161c2f6ff0aeaa8 (diff) | |
| download | focaccia-qemu-90a0778421acdf4ca903be64c8ed19378183c944.tar.gz focaccia-qemu-90a0778421acdf4ca903be64c8ed19378183c944.zip | |
hw/net/vmxnet3: Fix guest-triggerable assert()
The assert() that checks for valid MTU sizes can be triggered by
the guest (e.g. with the reproducer code from the bug ticket
https://gitlab.com/qemu-project/qemu/-/issues/517 ). Let's avoid
this problem by simply logging the error and refusing to activate
the device instead.
Fixes: d05dcd94ae ("net: vmxnet3: validate configuration values during activate")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
[Mjt: change format specifier from %d to %u for uint32_t argument]
Diffstat (limited to 'hw/net/vmxnet3.c')
| -rw-r--r-- | hw/net/vmxnet3.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index 5dfacb1098..3fb108751a 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1439,7 +1439,10 @@ static void vmxnet3_activate_device(VMXNET3State *s) vmxnet3_setup_rx_filtering(s); /* Cache fields from shared memory */ s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu); - assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu <= VMXNET3_MAX_MTU); + if (s->mtu < VMXNET3_MIN_MTU || s->mtu > VMXNET3_MAX_MTU) { + qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Bad MTU size: %u\n", s->mtu); + return; + } VMW_CFPRN("MTU is %u", s->mtu); s->max_rx_frags = |