| commit | 8ffb7265af64ec81748335ec8f20e7ab542c3850 | |
| author | Prasad J Pandit <pjp@fedoraproject.org> | |
| Tue, 24 Mar 2020 17:27:22 +0000 (24 22:57 +0530) | ||
| committer | Jason Wang <jasowang@redhat.com> | |
| Tue, 31 Mar 2020 13:14:35 +0000 (31 21:14 +0800) | ||
| tree | e33cdd16816ecaca46c9793c02a357cd71110d81 | treesnapshot (tar.gz zip) |
| parent | cca35ac4d16c0633a7d3bd28448e4ef52f0d46b0 | commitdiff |
net: tulip: check frame size and r/w data length
Tulip network driver while copying tx/rx buffers does not check
frame size against r/w data length. This may lead to OOB buffer
access. Add check to avoid it.
Limit iterations over descriptors to avoid potential infinite
loop issue in tulip_xmit_list_update.
Reported-by: Li Qiang <pangpei.lq@antfin.com>
Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Reported-by: Jason Wang <jasowang@redhat.com>
Tested-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Tulip network driver while copying tx/rx buffers does not check
frame size against r/w data length. This may lead to OOB buffer
access. Add check to avoid it.
Limit iterations over descriptors to avoid potential infinite
loop issue in tulip_xmit_list_update.
Reported-by: Li Qiang <pangpei.lq@antfin.com>
Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Reported-by: Jason Wang <jasowang@redhat.com>
Tested-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| hw/net/tulip.c | diffblobblamehistory |