On Fri, Jul 19, 2019 at 06:52:30PM +0000, Oleinik, Alexander wrote: > virtio_net_flush_tx does not check that the packet size is nonzero, > which causes q->aysnc_tx.elem to be set. Then, when the device is reset, there > is an assertion failure since q->aysnc_tx.elem must be flushed/cleared. > Zero-sized packets are unsupported - check packet size, prior to > sending. > > Found while fuzzing virtio-net. The relevant stack-trace: > #8 in __assert_fail (libc.so.6+0x30101) > #9 in virtio_net_reset virtio-net.c:520:13 > #10 in virtio_reset virtio.c:1214:9 > #11 in virtio_pci_reset virtio-pci.c:1810:5 > #12 in qdev_reset_one qdev.c:259:5 > #13 in qdev_walk_children qdev.c:575:15 > #14 in qbus_walk_children bus.c:52:15 > #15 in qdev_walk_children qdev.c:567:15 > #16 in qbus_walk_children bus.c:52:15 > #17 in qemu_devices_reset reset.c:69:9 > #18 in pc_machine_reset pc.c:2628:5 > #19 in qemu_system_reset vl.c:1621:9 > #20 in LLVMFuzzerTestOneInput fuzz.c:184:4 > > Signed-off-by: Alexander Oleinik <alx...@bu.edu> > --- > hw/net/virtio-net.c | 15 +++++++++------ > 1 file changed, 9 insertions(+), 6 deletions(-)
Reviewed-by: Stefan Hajnoczi <stefa...@redhat.com>
signature.asc
Description: PGP signature
