Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-18 Thread Jason Wang
On 01/19/2016 12:54 AM, Alistair Francis wrote: > On Mon, Jan 18, 2016 at 2:06 AM, Peter Maydell > wrote: >> On 18 January 2016 at 09:57, Jason Wang wrote: >>> Thanks for the pointer. >>> >>> In section 16.1.5, it said >>> >>> "Jumbo frames are not supported." >>> >>> So it was in fact not an

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-18 Thread Jason Wang
On 01/18/2016 06:06 PM, Peter Maydell wrote: > On 18 January 2016 at 09:57, Jason Wang wrote: >> Thanks for the pointer. >> >> In section 16.1.5, it said >> >> "Jumbo frames are not supported." >> >> So it was in fact not an unimplemented feature? > I have a vague feeling from the last time I lo

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-18 Thread Alistair Francis
On Mon, Jan 18, 2016 at 2:06 AM, Peter Maydell wrote: > On 18 January 2016 at 09:57, Jason Wang wrote: >> Thanks for the pointer. >> >> In section 16.1.5, it said >> >> "Jumbo frames are not supported." >> >> So it was in fact not an unimplemented feature? I'd say this should be a guest error th

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-18 Thread Peter Maydell
On 18 January 2016 at 09:57, Jason Wang wrote: > Thanks for the pointer. > > In section 16.1.5, it said > > "Jumbo frames are not supported." > > So it was in fact not an unimplemented feature? I have a vague feeling from the last time I looked at something like this that what often happens is th

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-17 Thread Jason Wang
On 01/15/2016 02:19 PM, Peter Crosthwaite wrote: > On Thu, Jan 14, 2016 at 2:03 AM, Peter Maydell > wrote: >> On 14 January 2016 at 09:43, Michael S. Tsirkin wrote: >>> gem_receive copies a packet received from network into an rxbuf[2048] >>> array on stack, with size limited by descriptor len

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-15 Thread P J P
+-- On Fri, 15 Jan 2016, Alistair Francis wrote --+ | Won't the allocation/reallocation happen on the host? Ah yes, don't know what I was thinking. -- - P J P 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-15 Thread Alistair Francis
On Fri, Jan 15, 2016 at 12:06 AM, P J P wrote: > +-- On Thu, 14 Jan 2016, Peter Crosthwaite wrote --+ > | I guess QEMU needs the whole packet before handing off to the net layer and > | the assumption is that the packet is always within 2048. The easiest > | solution is to realloc the buffer as it

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-15 Thread P J P
+-- On Thu, 14 Jan 2016, Peter Crosthwaite wrote --+ | I guess QEMU needs the whole packet before handing off to the net layer and | the assumption is that the packet is always within 2048. The easiest | solution is to realloc the buffer as it goes with the increasing sizes. Yes, I was conside

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-14 Thread Peter Crosthwaite
On Thu, Jan 14, 2016 at 2:03 AM, Peter Maydell wrote: > On 14 January 2016 at 09:43, Michael S. Tsirkin wrote: >> gem_receive copies a packet received from network into an rxbuf[2048] >> array on stack, with size limited by descriptor length set by guest. If >> guest is malicious and specifies a

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-14 Thread Michael S. Tsirkin
On Thu, Jan 14, 2016 at 10:03:15AM +, Peter Maydell wrote: > On 14 January 2016 at 09:43, Michael S. Tsirkin wrote: > > gem_receive copies a packet received from network into an rxbuf[2048] > > array on stack, with size limited by descriptor length set by guest. If > > guest is malicious and

Re: [Qemu-devel] [Qemu-arm] [PATCH] cadence_gem: fix buffer overflow

2016-01-14 Thread Peter Maydell
On 14 January 2016 at 09:43, Michael S. Tsirkin wrote: > gem_receive copies a packet received from network into an rxbuf[2048] > array on stack, with size limited by descriptor length set by guest. If > guest is malicious and specifies a descriptor length that is too large, > and should packet si