[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc()
From: |
Peter Maydell |
Subject: |
Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc() |
Date: |
Tue, 7 Aug 2018 14:45:24 +0100 |
On 7 August 2018 at 12:45, Peter Maydell <address@hidden> wrote:
> The data in an mbuf buffer is not necessarily at the start of the
> allocated buffer. (For instance m_adj() allows data to be trimmed
> from the start by just advancing the pointer and reducing the length.)
> This means that the allocated buffer size (m->m_size) and the
> amount of space from the m_data pointer to the end of the
> buffer (M_ROOM(m)) are not necessarily the same.
>
> Commit 864036e251f54c9 tried to change the m_inc() function from
> taking the new allocated-buffer-size to taking the new room-size,
> but forgot to change the initial "do we already have enough space"
> check. This meant that if we were trying to extend a buffer which
> had a leading gap between the buffer start and the data, we might
> incorrectly decide it didn't need to be extended, and then
> overrun the end of the buffer, causing memory corruption and
> an eventual crash.
>
> Change the "already big enough?" condition from checking the
> argument against m->m_size to checking against M_ROOM().
> This only makes a difference for the callsite in m_cat();
> the other three callsites all start with a freshly allocated
> mbuf from m_get(), which will have m->m_size == M_ROOM(m).
>
> Fixes: 864036e251f54c9
> Fixes: https://bugs.launchpad.net/qemu/+bug/1785670
> Signed-off-by: Peter Maydell <address@hidden>
> ---
Applied to master, thanks.
-- PMM
- [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Peter Maydell, 2018/08/07
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Samuel Thibault, 2018/08/07
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Dr. David Alan Gilbert, 2018/08/07
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Daniel P . Berrangé, 2018/08/07
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Thomas Huth, 2018/08/07
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Daniel P . Berrangé, 2018/08/07
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Peter Maydell, 2018/08/07
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Markus Armbruster, 2018/08/07
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Peter Maydell, 2018/08/07
Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(),
Peter Maydell <=
Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Dr. David Alan Gilbert, 2018/08/09
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Peter Maydell, 2018/08/09
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Dr. David Alan Gilbert, 2018/08/09
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Samuel Thibault, 2018/08/09
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Peter Maydell, 2018/08/10
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Samuel Thibault, 2018/08/10
- Re: [Qemu-devel] [PATCH for-3.0] slirp: Correct size check in m_inc(), Peter Maydell, 2018/08/10