[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] vmxnet3: Do not fill stats if device is inactiv
From: |
Jason Wang |
Subject: |
Re: [Qemu-devel] [PATCH] vmxnet3: Do not fill stats if device is inactive |
Date: |
Tue, 20 Oct 2015 12:42:26 +0800 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 |
On 10/15/2015 06:54 PM, Dana Rubin wrote:
> From: Shmulik Ladkani <address@hidden>
>
> Guest OS may issue VMXNET3_CMD_GET_STATS even before device was
> activated (for example in linux, after insmod but prior net-dev open).
>
> Accessing shared descriptors prior device activation is illegal as the
> VMXNET3State structures have not been fully initialized.
>
> As a result, guest memory gets corrupted and may lead to guest OS
> crashes.
>
> Fix, by not filling the stats descriptors if device is inactive.
>
> Reported-by: Leonid Shatz <address@hidden>
> Signed-off-by: Dana Rubin <address@hidden>
> Signed-off-by: Shmulik Ladkani <address@hidden>
> ---
> hw/net/vmxnet3.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
> index 3c5e10d..5e3a233 100644
> --- a/hw/net/vmxnet3.c
> +++ b/hw/net/vmxnet3.c
> @@ -1289,6 +1289,10 @@ static uint32_t
> vmxnet3_get_interrupt_config(VMXNET3State *s)
> static void vmxnet3_fill_stats(VMXNET3State *s)
> {
> int i;
> +
> + if (!s->device_active)
> + return;
> +
> for (i = 0; i < s->txq_num; i++) {
> cpu_physical_memory_write(s->txq_descr[i].tx_stats_pa,
> &s->txq_descr[i].txq_stats,
Applied in https://github.com/jasowang/qemu/commits/net
Thanks