On 09/16/2016 12:16 AM, Paolo Bonzini wrote:
On 06/09/2016 18:11, Maxime Coquelin wrote:
VirtIONet *n = VIRTIO_NET(vdev);
struct virtio_net_config netcfg;
+ if (virtio_vdev_has_feature(vdev, VIRTIO_NET_F_MTU)) {
+ virtio_stw_p(vdev, &netcfg.mtu, n->mtu);
+ }
This write needs to be unconditional, otherwise you are leaking a few
bytes of QEMU's stack (corresponding to netcfg.mtu) to the guest.
Right, thanks for pointing this out. I'll make it unconditional.
Maxime
Paolo
virtio_stw_p(vdev, &netcfg.status, n->status);
virtio_stw_p(vdev, &netcfg.max_virtqueue_pairs, n->max_queues);
memcpy(netcfg.mac, n->mac, ETH_ALEN);