On 09/16/2016 12:16 AM, Paolo Bonzini wrote:


On 06/09/2016 18:11, Maxime Coquelin wrote:
     VirtIONet *n = VIRTIO_NET(vdev);
     struct virtio_net_config netcfg;

+    if (virtio_vdev_has_feature(vdev, VIRTIO_NET_F_MTU)) {
+        virtio_stw_p(vdev, &netcfg.mtu, n->mtu);
+    }

This write needs to be unconditional, otherwise you are leaking a few
bytes of QEMU's stack (corresponding to netcfg.mtu) to the guest.

Right, thanks for pointing this out. I'll make it unconditional.

Maxime

Paolo

     virtio_stw_p(vdev, &netcfg.status, n->status);
     virtio_stw_p(vdev, &netcfg.max_virtqueue_pairs, n->max_queues);
     memcpy(netcfg.mac, n->mac, ETH_ALEN);

Reply via email to