From patchwork Tue Aug 9 07:34:31 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 657136 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3s7mL05nDRz9s3s for ; Tue, 9 Aug 2016 17:36:08 +1000 (AEST) Received: from localhost ([::1]:33983 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bX1a2-00020F-Fm for incoming@patchwork.ozlabs.org; Tue, 09 Aug 2016 03:36:06 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48665) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bX1Yi-00010z-3V for qemu-devel@nongnu.org; Tue, 09 Aug 2016 03:34:45 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bX1Ye-0003fo-8D for qemu-devel@nongnu.org; Tue, 09 Aug 2016 03:34:43 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40556) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bX1Ye-0003fk-2y; Tue, 09 Aug 2016 03:34:40 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A95A483F41; Tue, 9 Aug 2016 07:34:39 +0000 (UTC) Received: from jason-ThinkPad-T450s.redhat.com (vpn1-4-112.pek2.redhat.com [10.72.4.112]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u797YYPV006454; Tue, 9 Aug 2016 03:34:37 -0400 From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Date: Tue, 9 Aug 2016 15:34:31 +0800 Message-Id: <1470728073-30141-2-git-send-email-jasowang@redhat.com> In-Reply-To: <1470728073-30141-1-git-send-email-jasowang@redhat.com> References: <1470728073-30141-1-git-send-email-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Tue, 09 Aug 2016 07:34:39 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 1/3] net: check fragment length during fragmentation X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jason Wang , Prasad J Pandit , qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" From: Prasad J Pandit Network transport abstraction layer supports packet fragmentation. While fragmenting a packet, it checks for more fragments from packet length and current fragment length. It is susceptible to an infinite loop, if the current fragment length is zero. Add check to avoid it. Reported-by: Li Qiang Signed-off-by: Prasad J Pandit Reviewed-by: Dmitry Fleytman CC: qemu-stable@nongnu.org Signed-off-by: Jason Wang --- hw/net/net_tx_pkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c index efd43b4..53dfaa2 100644 --- a/hw/net/net_tx_pkt.c +++ b/hw/net/net_tx_pkt.c @@ -590,7 +590,7 @@ static bool net_tx_pkt_do_sw_fragmentation(struct NetTxPkt *pkt, fragment_offset += fragment_len; - } while (more_frags); + } while (fragment_len && more_frags); return true; }