From patchwork Fri Nov 5 20:52:08 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Williamson X-Patchwork-Id: 70294 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id BDDA61007D4 for ; Sat, 6 Nov 2010 07:54:26 +1100 (EST) Received: from localhost ([127.0.0.1]:44583 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PETIl-00072U-3W for incoming@patchwork.ozlabs.org; Fri, 05 Nov 2010 16:54:23 -0400 Received: from [140.186.70.92] (port=46650 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PETGs-00069i-To for qemu-devel@nongnu.org; Fri, 05 Nov 2010 16:52:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PETGd-0007NI-K2 for qemu-devel@nongnu.org; Fri, 05 Nov 2010 16:52:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:11356) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PETGd-0007ND-C3 for qemu-devel@nongnu.org; Fri, 05 Nov 2010 16:52:11 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id oA5KqAuT003227 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Fri, 5 Nov 2010 16:52:10 -0400 Received: from s20.home (ovpn01.gateway.prod.ext.phx2.redhat.com [10.5.9.1]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id oA5Kq8AR000546; Fri, 5 Nov 2010 16:52:09 -0400 From: Alex Williamson To: qemu-devel@nongnu.org Date: Fri, 05 Nov 2010 14:52:08 -0600 Message-ID: <20101105205148.8161.25164.stgit@s20.home> User-Agent: StGIT/0.14.3 MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. Cc: alex.williamson@redhat.com, dwu@redhat.com, mst@redhat.com Subject: [Qemu-devel] [PATCH] e1000: Fix TCP checksum overflow with TSO X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org When adding the length to the pseudo header, we're not properly accounting for overflow. From: Mark Wu Signed-off-by: Alex Williamson --- hw/e1000.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/hw/e1000.c b/hw/e1000.c index 532efdc..677165f 100644 --- a/hw/e1000.c +++ b/hw/e1000.c @@ -384,9 +384,12 @@ xmit_seg(E1000State *s) } else // UDP cpu_to_be16wu((uint16_t *)(tp->data+css+4), len); if (tp->sum_needed & E1000_TXD_POPTS_TXSM) { + unsigned int phsum; // add pseudo-header length before checksum calculation sp = (uint16_t *)(tp->data + tp->tucso); - cpu_to_be16wu(sp, be16_to_cpup(sp) + len); + phsum = be16_to_cpup(sp) + len; + phsum = (phsum >> 16) + (phsum & 0xffff); + cpu_to_be16wu(sp, phsum); } tp->tso_frames++; }