51a9cb48fd
CVE-2015-8558: DoS by infinite loop in ehci_advance_state (bz #1291309) CVE-2015-8666: Heap-based buffer overrun during VM migration (bz #1294027) CVE-2015-8744: vmxnet3: fix crash with short packets (bz #1295440) CVE-2015-8745: vmxnet3: don't assert reading registers in bar0 (bz #1295442)
35 lines
1.3 KiB
Diff
35 lines
1.3 KiB
Diff
From: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
|
|
Date: Mon, 21 Sep 2015 17:09:02 +0300
|
|
Subject: [PATCH] vmxnet3: Support reading IMR registers on bar0
|
|
|
|
Instead of asserting, return the actual IMR register value.
|
|
This is aligned with what's returned on ESXi.
|
|
|
|
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
|
|
Tested-by: Dana Rubin <dana.rubin@ravellosystems.com>
|
|
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
|
(cherry picked from commit c6048f849c7e3f009786df76206e895a69de032c)
|
|
---
|
|
hw/net/vmxnet3.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
|
|
index 71e7657..d2be2ae 100644
|
|
--- a/hw/net/vmxnet3.c
|
|
+++ b/hw/net/vmxnet3.c
|
|
@@ -1163,9 +1163,13 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr,
|
|
static uint64_t
|
|
vmxnet3_io_bar0_read(void *opaque, hwaddr addr, unsigned size)
|
|
{
|
|
+ VMXNET3State *s = opaque;
|
|
+
|
|
if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_IMR,
|
|
VMXNET3_MAX_INTRS, VMXNET3_REG_ALIGN)) {
|
|
- g_assert_not_reached();
|
|
+ int l = VMW_MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_IMR,
|
|
+ VMXNET3_REG_ALIGN);
|
|
+ return s->interrupt_states[l].is_masked;
|
|
}
|
|
|
|
VMW_CBPRN("BAR0 unknown read [%" PRIx64 "], size %d", addr, size);
|