3d039dc5d8
CVE-2016-9603: cirrus: heap buffer overflow via vnc connection (bz #1432040) CVE-2017-7377: 9pfs: fix file descriptor leak (bz #1437872) CVE-2017-7980: cirrus: OOB r/w access issues in bitblt (bz #1444372) CVE-2017-8112: vmw_pvscsi: infinite loop in pvscsi_log2 (bz #1445622) CVE-2017-8309: audio: host memory lekage via capture buffer (bz #1446520) CVE-2017-8379: input: host memory lekage via keyboard events (bz #1446560) CVE-2017-8380: scsi: megasas: out-of-bounds read in megasas_mmio_write (bz #1446578) CVE-2017-9060: virtio-gpu: host memory leakage in Virtio GPU device (bz #1452598) CVE-2017-9310: net: infinite loop in e1000e NIC emulation (bz #1452623) CVE-2017-9330: usb: ohci: infinite loop due to incorrect return value (bz #1457699) CVE-2017-9374: usb: ehci host memory leakage during hotunplug (bz #1459137) CVE-2017-10806: usb-redirect: stack buffer overflow in debug logging (bz #1468497)
50 lines
1.7 KiB
Diff
50 lines
1.7 KiB
Diff
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Date: Thu, 22 Sep 2016 16:02:37 +0530
|
|
Subject: [PATCH] net: mcf: limit buffer descriptor count
|
|
|
|
ColdFire Fast Ethernet Controller uses buffer descriptors to manage
|
|
data flow to/fro receive & transmit queues. While transmitting
|
|
packets, it could continue to read buffer descriptors if a buffer
|
|
descriptor has length of zero and has crafted values in bd.flags.
|
|
Set upper limit to number of buffer descriptors.
|
|
|
|
Reported-by: Li Qiang <liqiang6-s@360.cn>
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
|
(cherry picked from commit 070c4b92b8cd5390889716677a0b92444d6e087a)
|
|
---
|
|
hw/net/mcf_fec.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/net/mcf_fec.c b/hw/net/mcf_fec.c
|
|
index 0ee8ad9d66..d31fea1f18 100644
|
|
--- a/hw/net/mcf_fec.c
|
|
+++ b/hw/net/mcf_fec.c
|
|
@@ -23,6 +23,7 @@ do { printf("mcf_fec: " fmt , ## __VA_ARGS__); } while (0)
|
|
#define DPRINTF(fmt, ...) do {} while(0)
|
|
#endif
|
|
|
|
+#define FEC_MAX_DESC 1024
|
|
#define FEC_MAX_FRAME_SIZE 2032
|
|
|
|
typedef struct {
|
|
@@ -149,7 +150,7 @@ static void mcf_fec_do_tx(mcf_fec_state *s)
|
|
uint32_t addr;
|
|
mcf_fec_bd bd;
|
|
int frame_size;
|
|
- int len;
|
|
+ int len, descnt = 0;
|
|
uint8_t frame[FEC_MAX_FRAME_SIZE];
|
|
uint8_t *ptr;
|
|
|
|
@@ -157,7 +158,7 @@ static void mcf_fec_do_tx(mcf_fec_state *s)
|
|
ptr = frame;
|
|
frame_size = 0;
|
|
addr = s->tx_descriptor;
|
|
- while (1) {
|
|
+ while (descnt++ < FEC_MAX_DESC) {
|
|
mcf_fec_read_bd(&bd, addr);
|
|
DPRINTF("tx_bd %x flags %04x len %d data %08x\n",
|
|
addr, bd.flags, bd.length, bd.data);
|