network: 0.849
socket: 0.785
mistranslation: 0.751
device: 0.672
kernel: 0.603
peripherals: 0.577
ppc: 0.565
graphic: 0.561
files: 0.550
performance: 0.536
semantic: 0.531
user-level: 0.530
vnc: 0.511
register: 0.479
risc-v: 0.436
hypervisor: 0.431
arm: 0.423
architecture: 0.420
boot: 0.407
PID: 0.389
permissions: 0.367
TCG: 0.356
VMM: 0.321
virtual: 0.306
i386: 0.284
x86: 0.238
assembly: 0.233
debug: 0.210
KVM: 0.196

lan9118 bug peeked received message size not equal to actual received message size

peeked message is not equal to read message


Bug in the code at line:
https://github.com/qemu/qemu/blob/master/hw/net/lan9118.c#L1209

s->tx_status_fifo_head should be s->rx_status_fifo_head

Thanks,

Alfred

Do you have a test case that will reproduce this bug ?


(The line of code you point out is pretty clearly wrong; it would just be nice to have a test case to confirm that the obvious fix works.)

This patchset should fix this bug:
https://<email address hidden>/

PS: this isn't a security issue because the lan9118 is used only on board models that can't run under KVM and so it is not on QEMU's security boundary.


We do have some code, that is giving different results, between the peeked and the actual:

https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/blob/9a25860e761036a9eb780799c9db632e3eff60c9/portable/NetworkInterface/MPS2_AN385/NetworkInterface.c#L237

We also have a fix to circumvent the problem by just reading the actual size and omit the peeked bytes.

https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/pull/142

changing the code i pointed locally worked fine, but we can't expect all our users to compile qemu from scratch and apply a patch

Alfred

Fix now in master: commit e7e29fdbbe07f.