Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 25c01bd19d0e4b66f357618aeefda1ef7a41e21a
      
https://github.com/qemu/qemu/commit/25c01bd19d0e4b66f357618aeefda1ef7a41e21a
  Author: Jason Wang <jasow...@redhat.com>
  Date:   2018-12-04 (Tue, 04 Dec 2018)

  Changed paths:
    M include/net/net.h
    M net/net.c

  Log Message:
  -----------
  net: drop too large packet early

We try to detect and drop too large packet (>INT_MAX) in 1592a9947036
("net: ignore packet size greater than INT_MAX") during packet
delivering. Unfortunately, this is not sufficient as we may hit
another integer overflow when trying to queue such large packet in
qemu_net_queue_append_iov():

- size of the allocation may overflow on 32bit
- packet->size is integer which may overflow even on 64bit

Fixing this by moving the check to qemu_sendv_packet_async() which is
the entrance of all networking codes and reduce the limit to
NET_BUFSIZE to be more conservative. This works since:

- For the callers that call qemu_sendv_packet_async() directly, they
  only care about if zero is returned to determine whether to prevent
  the source from producing more packets. A callback will be triggered
  if peer can accept more then source could be enabled. This is
  usually used by high speed networking implementation like virtio-net
  or netmap.
- For the callers that call qemu_sendv_packet() that calls
  qemu_sendv_packet_async() indirectly, they often ignore the return
  value. In this case qemu will just the drop packets if peer can't
  receive.

Qemu will copy the packet if it was queued. So it was safe for both
kinds of the callers to assume the packet was sent.

Since we move the check from qemu_deliver_packet_iov() to
qemu_sendv_packet_async(), it would be safer to make
qemu_deliver_packet_iov() static to prevent any external user in the
future.

This is a revised patch of CVE-2018-17963.

Cc: qemu-sta...@nongnu.org
Cc: Li Qiang <liq...@163.com>
Fixes: 1592a9947036 ("net: ignore packet size greater than INT_MAX")
Reported-by: Li Qiang <liq...@gmail.com>
Reviewed-by: Li Qiang <liq...@gmail.com>
Signed-off-by: Jason Wang <jasow...@redhat.com>
Reviewed-by: Thomas Huth <th...@redhat.com>
Message-id: 20181204035347.6148-2-jasow...@redhat.com
Signed-off-by: Peter Maydell <peter.mayd...@linaro.org>


  Commit: 56512e1dc1c6a00d37da09baa35981908fb9b5c7
      
https://github.com/qemu/qemu/commit/56512e1dc1c6a00d37da09baa35981908fb9b5c7
  Author: Jason Wang <jasow...@redhat.com>
  Date:   2018-12-04 (Tue, 04 Dec 2018)

  Changed paths:
    M net/hub.c

  Log Message:
  -----------
  net: hub: suppress warnings of no host network for qtest

If we want to qtest through hub, it would be much more simpler and
safer to configure the hub without host network. So silent this
warnings for qtest.

Signed-off-by: Jason Wang <jasow...@redhat.com>
Reviewed-by: Thomas Huth <th...@redhat.com>
Message-id: 20181204035347.6148-3-jasow...@redhat.com
Signed-off-by: Peter Maydell <peter.mayd...@linaro.org>


  Commit: ae4c445c6f38a01504b7040b1e01a69945137b0c
      
https://github.com/qemu/qemu/commit/ae4c445c6f38a01504b7040b1e01a69945137b0c
  Author: Jason Wang <jasow...@redhat.com>
  Date:   2018-12-04 (Tue, 04 Dec 2018)

  Changed paths:
    M tests/virtio-net-test.c

  Log Message:
  -----------
  virtio-net-test: accept variable length argument in pci_test_start()

This allows flexibility to be reused for all kinds of command line
used by other tests.

Reviewed-by: Eric Blake <ebl...@redhat.com>
Reviewed-by: Thomas Huth <th...@redhat.com>
Signed-off-by: Jason Wang <jasow...@redhat.com>
Message-id: 20181204035347.6148-4-jasow...@redhat.com
Signed-off-by: Peter Maydell <peter.mayd...@linaro.org>


  Commit: 432a82d72720f71cb965b64836672f19d57ceedb
      
https://github.com/qemu/qemu/commit/432a82d72720f71cb965b64836672f19d57ceedb
  Author: Jason Wang <jasow...@redhat.com>
  Date:   2018-12-04 (Tue, 04 Dec 2018)

  Changed paths:
    M tests/virtio-net-test.c

  Log Message:
  -----------
  virtio-net-test: remove unused macro

Reviewed-by: Thomas Huth <th...@redhat.com>
Reviewed-by: Eric Blake <ebl...@redhat.com>
Signed-off-by: Jason Wang <jasow...@redhat.com>
Message-id: 20181204035347.6148-5-jasow...@redhat.com
Signed-off-by: Peter Maydell <peter.mayd...@linaro.org>


  Commit: 118cafff251318d16e1cfdef9cbf6b7d1e74cdb5
      
https://github.com/qemu/qemu/commit/118cafff251318d16e1cfdef9cbf6b7d1e74cdb5
  Author: Jason Wang <jasow...@redhat.com>
  Date:   2018-12-04 (Tue, 04 Dec 2018)

  Changed paths:
    M tests/virtio-net-test.c

  Log Message:
  -----------
  virtio-net-test: add large tx buffer test

This test tries to build a packet whose size is greater than INT_MAX
which tries to trigger integer overflow in qemu_net_queue_append_iov()
which may result OOB.

Signed-off-by: Jason Wang <jasow...@redhat.com>
Reviewed-by: Thomas Huth <th...@redhat.com>
Message-id: 20181204035347.6148-6-jasow...@redhat.com
Signed-off-by: Peter Maydell <peter.mayd...@linaro.org>


Compare: https://github.com/qemu/qemu/compare/933cc4bb3469...118cafff2513
      **NOTE:** This service has been marked for deprecation: 
https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.

Reply via email to