hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment()
An assertion failure issue was found in the code that processes network packets while adding data fragments into the packet context. It could be abused by a malicious guest to abort the QEMU process on the host. This patch replaces the affected assert() with a conditional statement, returning false if the current data fragment exceeds max_raw_frags. Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Ziming Zhang <ezrakiez@gmail.com> Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
This commit is contained in:
parent
f81cddfe8a
commit
035e69b063
|
@ -379,7 +379,10 @@ bool net_tx_pkt_add_raw_fragment(struct NetTxPkt *pkt, hwaddr pa,
|
||||||
hwaddr mapped_len = 0;
|
hwaddr mapped_len = 0;
|
||||||
struct iovec *ventry;
|
struct iovec *ventry;
|
||||||
assert(pkt);
|
assert(pkt);
|
||||||
assert(pkt->max_raw_frags > pkt->raw_frags);
|
|
||||||
|
if (pkt->raw_frags >= pkt->max_raw_frags) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
if (!len) {
|
if (!len) {
|
||||||
return true;
|
return true;
|
||||||
|
|
Loading…
Reference in a new issue