diff options
| author | Li Qiang | 2016-08-08 14:38:31 +0200 |
|---|---|---|
| committer | Jason Wang | 2016-08-09 09:24:56 +0200 |
| commit | 6c352ca9b4ee3e1e286ea9e8434bd8e69ac7d0d8 (patch) | |
| tree | 8913f14f53cb99b460745044a1ee05f2c72639af | |
| parent | net: check fragment length during fragmentation (diff) | |
| download | qemu-6c352ca9b4ee3e1e286ea9e8434bd8e69ac7d0d8.tar.gz qemu-6c352ca9b4ee3e1e286ea9e8434bd8e69ac7d0d8.tar.xz qemu-6c352ca9b4ee3e1e286ea9e8434bd8e69ac7d0d8.zip | |
net: vmxnet3: check for device_active before write
Vmxnet3 device emulator does not check if the device is active,
before using it for write. It leads to a use after free issue,
if the vmxnet3_io_bar0_write routine is called after the device is
deactivated. Add check to avoid it.
Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Acked-by: Dmitry Fleytman <dmitry@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| -rw-r--r-- | hw/net/vmxnet3.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index bbf44adbcc..90f6943668 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1167,6 +1167,10 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr, { VMXNET3State *s = opaque; + if (!s->device_active) { + return; + } + if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_TXPROD, VMXNET3_DEVICE_MAX_TX_QUEUES, VMXNET3_REG_ALIGN)) { int tx_queue_idx = |