Branch: refs/heads/master Home: https://github.com/qemu/qemu Commit: 25c01bd19d0e4b66f357618aeefda1ef7a41e21a https://github.com/qemu/qemu/commit/25c01bd19d0e4b66f357618aeefda1ef7a41e21a Author: Jason Wang <jasow...@redhat.com> Date: 2018-12-04 (Tue, 04 Dec 2018)
Changed paths: M include/net/net.h M net/net.c Log Message: ----------- net: drop too large packet early We try to detect and drop too large packet (>INT_MAX) in 1592a9947036 ("net: ignore packet size greater than INT_MAX") during packet delivering. Unfortunately, this is not sufficient as we may hit another integer overflow when trying to queue such large packet in qemu_net_queue_append_iov(): - size of the allocation may overflow on 32bit - packet->size is integer which may overflow even on 64bit Fixing this by moving the check to qemu_sendv_packet_async() which is the entrance of all networking codes and reduce the limit to NET_BUFSIZE to be more conservative. This works since: - For the callers that call qemu_sendv_packet_async() directly, they only care about if zero is returned to determine whether to prevent the source from producing more packets. A callback will be triggered if peer can accept more then source could be enabled. This is usually used by high speed networking implementation like virtio-net or netmap. - For the callers that call qemu_sendv_packet() that calls qemu_sendv_packet_async() indirectly, they often ignore the return value. In this case qemu will just the drop packets if peer can't receive. Qemu will copy the packet if it was queued. So it was safe for both kinds of the callers to assume the packet was sent. Since we move the check from qemu_deliver_packet_iov() to qemu_sendv_packet_async(), it would be safer to make qemu_deliver_packet_iov() static to prevent any external user in the future. This is a revised patch of CVE-2018-17963. Cc: qemu-sta...@nongnu.org Cc: Li Qiang <liq...@163.com> Fixes: 1592a9947036 ("net: ignore packet size greater than INT_MAX") Reported-by: Li Qiang <liq...@gmail.com> Reviewed-by: Li Qiang <liq...@gmail.com> Signed-off-by: Jason Wang <jasow...@redhat.com> Reviewed-by: Thomas Huth <th...@redhat.com> Message-id: 20181204035347.6148-2-jasow...@redhat.com Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 56512e1dc1c6a00d37da09baa35981908fb9b5c7 https://github.com/qemu/qemu/commit/56512e1dc1c6a00d37da09baa35981908fb9b5c7 Author: Jason Wang <jasow...@redhat.com> Date: 2018-12-04 (Tue, 04 Dec 2018) Changed paths: M net/hub.c Log Message: ----------- net: hub: suppress warnings of no host network for qtest If we want to qtest through hub, it would be much more simpler and safer to configure the hub without host network. So silent this warnings for qtest. Signed-off-by: Jason Wang <jasow...@redhat.com> Reviewed-by: Thomas Huth <th...@redhat.com> Message-id: 20181204035347.6148-3-jasow...@redhat.com Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: ae4c445c6f38a01504b7040b1e01a69945137b0c https://github.com/qemu/qemu/commit/ae4c445c6f38a01504b7040b1e01a69945137b0c Author: Jason Wang <jasow...@redhat.com> Date: 2018-12-04 (Tue, 04 Dec 2018) Changed paths: M tests/virtio-net-test.c Log Message: ----------- virtio-net-test: accept variable length argument in pci_test_start() This allows flexibility to be reused for all kinds of command line used by other tests. Reviewed-by: Eric Blake <ebl...@redhat.com> Reviewed-by: Thomas Huth <th...@redhat.com> Signed-off-by: Jason Wang <jasow...@redhat.com> Message-id: 20181204035347.6148-4-jasow...@redhat.com Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 432a82d72720f71cb965b64836672f19d57ceedb https://github.com/qemu/qemu/commit/432a82d72720f71cb965b64836672f19d57ceedb Author: Jason Wang <jasow...@redhat.com> Date: 2018-12-04 (Tue, 04 Dec 2018) Changed paths: M tests/virtio-net-test.c Log Message: ----------- virtio-net-test: remove unused macro Reviewed-by: Thomas Huth <th...@redhat.com> Reviewed-by: Eric Blake <ebl...@redhat.com> Signed-off-by: Jason Wang <jasow...@redhat.com> Message-id: 20181204035347.6148-5-jasow...@redhat.com Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Commit: 118cafff251318d16e1cfdef9cbf6b7d1e74cdb5 https://github.com/qemu/qemu/commit/118cafff251318d16e1cfdef9cbf6b7d1e74cdb5 Author: Jason Wang <jasow...@redhat.com> Date: 2018-12-04 (Tue, 04 Dec 2018) Changed paths: M tests/virtio-net-test.c Log Message: ----------- virtio-net-test: add large tx buffer test This test tries to build a packet whose size is greater than INT_MAX which tries to trigger integer overflow in qemu_net_queue_append_iov() which may result OOB. Signed-off-by: Jason Wang <jasow...@redhat.com> Reviewed-by: Thomas Huth <th...@redhat.com> Message-id: 20181204035347.6148-6-jasow...@redhat.com Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> Compare: https://github.com/qemu/qemu/compare/933cc4bb3469...118cafff2513 **NOTE:** This service has been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/ Functionality will be removed from GitHub.com on January 31st, 2019.