Re: [PATCH] rtl8139: fix large_send_mss divide-by-zero

[Alexander Bulekov]

On 230413 1319, Stefan Hajnoczi wrote:
> If the driver sets large_send_mss to 0 then a divide-by-zero occurs.
> Even if the division wasn't a problem, the for loop that emits MSS-sized
> packets would never terminate.
> 
> Solve these issues by skipping offloading when large_send_mss=0.
> 
> This issue was found by OSS-Fuzz as part of Alexander Bulekov's device
> fuzzing work. The reproducer is:
> 
>   $ cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
>   512M,slots=1,maxmem=0xffff000000000000 -machine q35 -nodefaults -device \
>   rtl8139,netdev=net0 -netdev user,id=net0 -device \
>   pc-dimm,id=nv1,memdev=mem1,addr=0xb800a64602800000 -object \
>   memory-backend-ram,id=mem1,size=2M  -qtest stdio
>   outl 0xcf8 0x80000814
>   outl 0xcfc 0xe0000000
>   outl 0xcf8 0x80000804
>   outw 0xcfc 0x06
>   write 0xe0000037 0x1 0x04
>   write 0xe00000e0 0x2 0x01
>   write 0x1 0x1 0x04
>   write 0x3 0x1 0x98
>   write 0xa 0x1 0x8c
>   write 0xb 0x1 0x02
>   write 0xc 0x1 0x46
>   write 0xd 0x1 0xa6
>   write 0xf 0x1 0xb8
>   write 0xb800a646028c000c 0x1 0x08
>   write 0xb800a646028c000e 0x1 0x47
>   write 0xb800a646028c0010 0x1 0x02
>   write 0xb800a646028c0017 0x1 0x06
>   write 0xb800a646028c0036 0x1 0x80
>   write 0xe00000d9 0x1 0x40
>   EOF
> 
> Buglink: https://gitlab.com/qemu-project/qemu/-/issues/1582

Maybe instead:
Closes: https://gitlab.com/qemu-project/qemu/-/issues/1582

so that gitlab will auto-close the issue.

Tested-by: Alexander Bulekov <alxndr@bu.edu>

Thank you
-Alex

> Fixes: 6d71357a3b65 ("rtl8139: honor large send MSS value")
> Reported-by: Alexander Bulekov <alxndr@bu.edu>
> Cc: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
>  hw/net/rtl8139.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
> index 5a5aaf868d..5f1a4d359b 100644
> --- a/hw/net/rtl8139.c
> +++ b/hw/net/rtl8139.c
> @@ -2154,6 +2154,9 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
>  
>                  int large_send_mss = (txdw0 >> CP_TC_LGSEN_MSS_SHIFT) &
>                                       CP_TC_LGSEN_MSS_MASK;
> +                if (large_send_mss == 0) {
> +                    goto skip_offload;
> +                }
>  
>                  DPRINTF("+++ C+ mode offloaded task TSO IP data %d "
>                      "frame data %d specified MSS=%d\n",
> -- 
> 2.39.2
>