* Dmitry Fleytman (dmi...@daynix.com) wrote:
>
> On Apr 1, 2014, at 14:33 PM, Dr. David Alan Gilbert <dgilb...@redhat.com>
> wrote:
>
> > * Michael S. Tsirkin (m...@redhat.com) wrote:
> >> From: Dmitry Fleytman <dmi...@daynix.com>
> >>
> >> CVE-2013-4544
> >>
> >> Signed-off-by: Dmitry Fleytman <dmi...@daynix.com>
> >> Reported-by: Michael S. Tsirkin <m...@redhat.com>
> >> Signed-off-by: Michael S. Tsirkin <m...@redhat.com>
> >> ---
> >> hw/net/vmxnet3.c | 36 ++++++++++++++++++++++++++++++++++--
> >> 1 file changed, 34 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
> >> index 5be807c..a4b5c11 100644
> >> --- a/hw/net/vmxnet3.c
> >> +++ b/hw/net/vmxnet3.c
> >> @@ -52,6 +52,9 @@
> >> #define VMXNET3_DEVICE_VERSION 0x1
> >> #define VMXNET3_DEVICE_REVISION 0x1
> >>
> >> +/* Number of interrupt vectors for INTx/MSI */
> >> +#define VMXNET3_MAX_NMSIX_INTRS (1)
> >
> > As per Dmitry's reply this is apparently the number of non-MSIX
> > interrupts; can we change the comment to make this clear.
>
> Not sure how to change it.
> There are three modes of operation:
> 1. INTx - 1 interrupt is used
> 2. MSI - 1 interrupt is used
> 3. MSIx - up to 25 interrupts are used.
>
> This define covers 2 first modes of operation.
> Would something like
>
> /* Number of interrupt vectors for non-MSIx modes */
>
> be better?
Yes - that's fine.
Dave
>
>
> >
> >> +
> >> /* Macros for rings descriptors access */
> >> #define VMXNET3_READ_TX_QUEUE_DESCR8(dpa, field) \
> >> (vmw_shmem_ld8(dpa + offsetof(struct Vmxnet3_TxQueueDesc, field)))
> >> @@ -1305,6 +1308,34 @@ static bool vmxnet3_verify_intx(VMXNET3State *s,
> >> int intx)
> >> (pci_get_byte(s->parent_obj.config + PCI_INTERRUPT_PIN) - 1));
> >> }
> >>
> >> +static void vmxnet3_validate_interrupt_idx(bool is_msix, int idx)
> >> +{
> >> + int max_ints = is_msix ? VMXNET3_MAX_INTRS : VMXNET3_MAX_NMSIX_INTRS;
> >> + if (idx >= max_ints) {
> >> + hw_error("Bad interrupt index: %d\n", idx);
> >> + }
> >
> > Can we avoid hw_error here, we're using in this in state load, so I'm
> > OK at the thought of error_report, but then we should make
> > this return a bool to say it's failed and bubble this up so
> > that it just fails the post_load test like any other bad state load.
> >
> > Dave
> >
> >> +}
> >> +
> >> +static void vmxnet3_validate_interrupts(VMXNET3State *s)
> >> +{
> >> + int i;
> >> +
> >> + VMW_CFPRN("Verifying event interrupt index (%d)", s->event_int_idx);
> >> + vmxnet3_validate_interrupt_idx(s->msix_used, s->event_int_idx);
> >> +
> >> + for (i = 0; i < s->txq_num; i++) {
> >> + int idx = s->txq_descr[i].intr_idx;
> >> + VMW_CFPRN("Verifying TX queue %d interrupt index (%d)", i, idx);
> >> + vmxnet3_validate_interrupt_idx(s->msix_used, idx);
> >> + }
> >> +
> >> + for (i = 0; i < s->rxq_num; i++) {
> >> + int idx = s->rxq_descr[i].intr_idx;
> >> + VMW_CFPRN("Verifying RX queue %d interrupt index (%d)", i, idx);
> >> + vmxnet3_validate_interrupt_idx(s->msix_used, idx);
> >> + }
> >> +}
> >> +
> >> static void vmxnet3_activate_device(VMXNET3State *s)
> >> {
> >> int i;
> >> @@ -1447,6 +1478,8 @@ static void vmxnet3_activate_device(VMXNET3State *s)
> >> sizeof(s->rxq_descr[i].rxq_stats));
> >> }
> >>
> >> + vmxnet3_validate_interrupts(s);
> >> +
> >> /* Make sure everything is in place before device activation */
> >> smp_wmb();
> >>
> >> @@ -2005,7 +2038,6 @@ vmxnet3_cleanup_msix(VMXNET3State *s)
> >> }
> >> }
> >>
> >> -#define VMXNET3_MSI_NUM_VECTORS (1)
> >> #define VMXNET3_MSI_OFFSET (0x50)
> >> #define VMXNET3_USE_64BIT (true)
> >> #define VMXNET3_PER_VECTOR_MASK (false)
> >> @@ -2016,7 +2048,7 @@ vmxnet3_init_msi(VMXNET3State *s)
> >> PCIDevice *d = PCI_DEVICE(s);
> >> int res;
> >>
> >> - res = msi_init(d, VMXNET3_MSI_OFFSET, VMXNET3_MSI_NUM_VECTORS,
> >> + res = msi_init(d, VMXNET3_MSI_OFFSET, VMXNET3_MAX_NMSIX_INTRS,
> >> VMXNET3_USE_64BIT, VMXNET3_PER_VECTOR_MASK);
> >> if (0 > res) {
> >> VMW_WRPRN("Failed to initialize MSI, error %d", res);
> >> --
> >> MST
> >>
> > --
> > Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK
>
--
Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK
