Re: [Qemu-devel] [PATCH 1/2] net: pcnet: check rx/tx descriptor ring length

[Jason Wang]

On 2016年09月30日 13:36, P J P wrote:
>    Hello Jason,
>
> +-- On Fri, 30 Sep 2016, Jason Wang wrote --+
> | On 2016年09月30日 02:57, P J P wrote:
> | > The AMD PC-Net II emulator has set of control and status(CSR)
> | > registers. Of these, CSR76 and CSR78 hold receive and transmit
> | > descriptor ring length respectively. This ring length could range
> | > from 1 to 65535. Setting ring length to zero leads to an infinite
> | > loop in pcnet_rdra_addr. Add check to avoid it.
> |
> | In this case, we only need to protect RCVRL I believe? (since XMTRL were not
> | used).
>
>    XMTRL is not used in this case, but could be prone to similar issues. For
> ex.
>
>      static void pcnet_transmit(PCNetState *s)
>      {
>          int count = CSR_XMTRL(s) - 1;
>          ...
>          if (count--)
>              goto txagain;
>      }
>
> If CSR_XMTRL is set to zero(0), 'count' would never reach zero and function
> would continue to jump to 'txagain'.

Applied and tweak the commit log by mentioning pcnet_transmit() too.

Thanks

> Thank you.
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F