diff options
| author | Akihiko Odaki <akihiko.odaki@daynix.com> | 2023-02-23 19:20:03 +0900 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2023-03-10 15:35:38 +0800 |
| commit | f9a9eb16e2f19754ae32994c8c62a5b1d5dc2169 (patch) | |
| tree | 632976214f0f0dacd1ede7fda7356dc5e3a1de66 /hw/net/vmxnet3.c | |
| parent | 156dc1555d98be9e7572138068e633c38aabc38e (diff) | |
| download | focaccia-qemu-f9a9eb16e2f19754ae32994c8c62a5b1d5dc2169.tar.gz focaccia-qemu-f9a9eb16e2f19754ae32994c8c62a5b1d5dc2169.zip | |
net: Check L4 header size
net_tx_pkt_build_vheader() inspects TCP header but had no check for the header size, resulting in an undefined behavior. Check the header size and drop the packet if the header is too small. Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw/net/vmxnet3.c')
| -rw-r--r-- | hw/net/vmxnet3.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index 56559cda24..d7d492ac5a 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -440,19 +440,19 @@ vmxnet3_setup_tx_offloads(VMXNET3State *s) { switch (s->offload_mode) { case VMXNET3_OM_NONE: - net_tx_pkt_build_vheader(s->tx_pkt, false, false, 0); - break; + return net_tx_pkt_build_vheader(s->tx_pkt, false, false, 0); case VMXNET3_OM_CSUM: - net_tx_pkt_build_vheader(s->tx_pkt, false, true, 0); VMW_PKPRN("L4 CSO requested\n"); - break; + return net_tx_pkt_build_vheader(s->tx_pkt, false, true, 0); case VMXNET3_OM_TSO: - net_tx_pkt_build_vheader(s->tx_pkt, true, true, - s->cso_or_gso_size); - net_tx_pkt_update_ip_checksums(s->tx_pkt); VMW_PKPRN("GSO offload requested."); + if (!net_tx_pkt_build_vheader(s->tx_pkt, true, true, + s->cso_or_gso_size)) { + return false; + } + net_tx_pkt_update_ip_checksums(s->tx_pkt); break; default: |