b5fb5e90fb
memory in rtl8139 device model xsa140-qemuu-1.patch xsa140-qemuu-2.patch xsa140-qemuu-3.patch xsa140-qemuu-4.patch xsa140-qemuu-5.patch xsa140-qemuu-6.patch xsa140-qemuu-7.patch xsa140-qemut-1.patch xsa140-qemut-2.patch xsa140-qemut-3.patch xsa140-qemut-4.patch xsa140-qemut-5.patch xsa140-qemut-6.patch xsa140-qemut-7.patch - bsc#939709 - VUL-0: XSA-139: xen: Use after free in QEMU/Xen block unplug protocol xsa139-qemuu.patch - bsc#937371 - xen vm's running after reboot xendomains-libvirtd-conflict.patch - bsc#938344 - VUL-0: CVE-2015-5154: qemu,kvm,xen: host code execution via IDE subsystem CD-ROM CVE-2015-5154-qemuu-check-array-bounds-before-writing-to-io_buffer.patch CVE-2015-5154-qemut-check-array-bounds-before-writing-to-io_buffer.patch CVE-2015-5154-qemuu-fix-START-STOP-UNIT-command-completion.patch CVE-2015-5154-qemut-fix-START-STOP-UNIT-command-completion.patch CVE-2015-5154-qemuu-clear-DRQ-after-handling-all-expected-accesses.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=371
81 lines
3.0 KiB
Diff
81 lines
3.0 KiB
Diff
References: bsc#939712 XSA-140
|
|
|
|
From 5e0c290415b9d57077a86e70c8e6a058868334d3 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Date: Wed, 15 Jul 2015 18:16:58 +0100
|
|
Subject: [PATCH 1/7] rtl8139: avoid nested ifs in IP header parsing
|
|
|
|
Transmit offload needs to parse packet headers. If header fields have
|
|
unexpected values the offload processing is skipped.
|
|
|
|
The code currently uses nested ifs because there is relatively little
|
|
input validation. The next patches will add missing input validation
|
|
and a goto label is more appropriate to avoid deep if statement nesting.
|
|
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
---
|
|
hw/net/rtl8139.c | 41 ++++++++++++++++++++++-------------------
|
|
1 file changed, 22 insertions(+), 19 deletions(-)
|
|
|
|
Index: xen-4.5.1-testing/tools/qemu-xen-dir-remote/hw/net/rtl8139.c
|
|
===================================================================
|
|
--- xen-4.5.1-testing.orig/tools/qemu-xen-dir-remote/hw/net/rtl8139.c
|
|
+++ xen-4.5.1-testing/tools/qemu-xen-dir-remote/hw/net/rtl8139.c
|
|
@@ -2171,28 +2171,30 @@ static int rtl8139_cplus_transmit_one(RT
|
|
size_t eth_payload_len = 0;
|
|
|
|
int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
|
|
- if (proto == ETH_P_IP)
|
|
+ if (proto != ETH_P_IP)
|
|
{
|
|
- DPRINTF("+++ C+ mode has IP packet\n");
|
|
+ goto skip_offload;
|
|
+ }
|
|
|
|
- /* not aligned */
|
|
- eth_payload_data = saved_buffer + ETH_HLEN;
|
|
- eth_payload_len = saved_size - ETH_HLEN;
|
|
-
|
|
- ip = (ip_header*)eth_payload_data;
|
|
-
|
|
- if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
|
|
- DPRINTF("+++ C+ mode packet has bad IP version %d "
|
|
- "expected %d\n", IP_HEADER_VERSION(ip),
|
|
- IP_HEADER_VERSION_4);
|
|
- ip = NULL;
|
|
- } else {
|
|
- hlen = IP_HEADER_LENGTH(ip);
|
|
- ip_protocol = ip->ip_p;
|
|
- ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
|
|
- }
|
|
+ DPRINTF("+++ C+ mode has IP packet\n");
|
|
+
|
|
+ /* not aligned */
|
|
+ eth_payload_data = saved_buffer + ETH_HLEN;
|
|
+ eth_payload_len = saved_size - ETH_HLEN;
|
|
+
|
|
+ ip = (ip_header*)eth_payload_data;
|
|
+
|
|
+ if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
|
|
+ DPRINTF("+++ C+ mode packet has bad IP version %d "
|
|
+ "expected %d\n", IP_HEADER_VERSION(ip),
|
|
+ IP_HEADER_VERSION_4);
|
|
+ goto skip_offload;
|
|
}
|
|
|
|
+ hlen = IP_HEADER_LENGTH(ip);
|
|
+ ip_protocol = ip->ip_p;
|
|
+ ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
|
|
+
|
|
if (ip)
|
|
{
|
|
if (txdw0 & CP_TX_IPCS)
|
|
@@ -2388,6 +2390,7 @@ static int rtl8139_cplus_transmit_one(RT
|
|
}
|
|
}
|
|
|
|
+skip_offload:
|
|
/* update tally counter */
|
|
++s->tally_counters.TxOk;
|
|
|