diff options
| author | Dmitry Frolov <frolov@swemel.ru> | 2024-06-13 17:35:30 +0300 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2024-07-01 17:16:05 -0400 |
| commit | d4f471eb7e562c2cc398448a1c1e7ee838ec30bd (patch) | |
| tree | 3cbfe19e9ad14ed376139d13f33217b551dc22d2 /hw/net | |
| parent | 7c211eb078c42146ee9a441cc028fbc4c378ef5a (diff) | |
hw/net/virtio-net.c: fix crash in iov_copy()
A crash found while fuzzing device virtio-net-socket-check-used.
Assertion "offset == 0" in iov_copy() fails if less than guest_hdr_len bytes
were transmited.
Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
Message-Id: <20240613143529.602591-2-frolov@swemel.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/net')
| -rw-r--r-- | hw/net/virtio-net.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 9c7e85caea..8f30972708 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -2735,6 +2735,10 @@ static int32_t virtio_net_flush_tx(VirtIONetQueue *q) */ assert(n->host_hdr_len <= n->guest_hdr_len); if (n->host_hdr_len != n->guest_hdr_len) { + if (iov_size(out_sg, out_num) < n->guest_hdr_len) { + virtio_error(vdev, "virtio-net header is invalid"); + goto detach; + } unsigned sg_num = iov_copy(sg, ARRAY_SIZE(sg), out_sg, out_num, 0, n->host_hdr_len); |