[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL V2 05/10] hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value
From: |
Jason Wang |
Subject: |
[PULL V2 05/10] hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value |
Date: |
Thu, 16 Feb 2023 13:24:19 +0800 |
From: Fiona Ebner <f.ebner@proxmox.com>
Currently, VMXNET3_MAX_MTU itself (being 9000) is not considered a
valid value for the MTU, but a guest running ESXi 7.0 might try to
set it and fail the assert [0].
In the Linux kernel, dev->max_mtu itself is a valid value for the MTU
and for the vmxnet3 driver it's 9000, so a guest running Linux will
also fail the assert when trying to set an MTU of 9000.
VMXNET3_MAX_MTU and s->mtu don't seem to be used in relation to buffer
allocations/accesses, so allowing the upper limit itself as a value
should be fine.
[0]: https://forum.proxmox.com/threads/114011/
Fixes: d05dcd94ae ("net: vmxnet3: validate configuration values during activate
(CVE-2021-20203)")
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
hw/net/vmxnet3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index d2ab527..56559cd 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -1441,7 +1441,7 @@ static void vmxnet3_activate_device(VMXNET3State *s)
vmxnet3_setup_rx_filtering(s);
/* Cache fields from shared memory */
s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
- assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu < VMXNET3_MAX_MTU);
+ assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu <= VMXNET3_MAX_MTU);
VMW_CFPRN("MTU is %u", s->mtu);
s->max_rx_frags =
--
2.7.4
- [PULL V2 00/10] Net patches, Jason Wang, 2023/02/16
- [PULL V2 02/10] net: Restore printing of the help text with "-nic help", Jason Wang, 2023/02/16
- [PULL V2 01/10] net: Move the code to collect available NIC models to a separate function, Jason Wang, 2023/02/16
- [PULL V2 05/10] hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value,
Jason Wang <=
- [PULL V2 03/10] net: Replace "Supported NIC models" with "Available NIC models", Jason Wang, 2023/02/16
- [PULL V2 06/10] net: Increase L2TPv3 buffer to fit jumboframes, Jason Wang, 2023/02/16
- [PULL V2 04/10] hw/net/lan9118: log [read|write]b when mode_16bit is enabled rather than abort, Jason Wang, 2023/02/16
- [PULL V2 07/10] vmnet: stop recieving events when VM is stopped, Jason Wang, 2023/02/16
- [PULL V2 08/10] hw/net/can/xlnx-zynqmp-can: fix assertion failures in transfer_fifo(), Jason Wang, 2023/02/16
- [PULL V2 10/10] vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check, Jason Wang, 2023/02/16
- [PULL V2 09/10] net: stream: add a new option to automatically reconnect, Jason Wang, 2023/02/16
- Re: [PULL V2 00/10] Net patches, Philippe Mathieu-Daudé, 2023/02/16