Commit 6c352ca9 authored by Li Qiang's avatar Li Qiang Committed by Jason Wang
Browse files

net: vmxnet3: check for device_active before write 



Vmxnet3 device emulator does not check if the device is active,
before using it for write. It leads to a use after free issue,
if the vmxnet3_io_bar0_write routine is called after the device is
deactivated. Add check to avoid it.

Reported-by: default avatarLi Qiang <liqiang6-s@360.cn>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Acked-by: default avatarDmitry Fleytman <dmitry@daynix.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
parent ead315e4

hw/net/vmxnet3.c

+4 −0
Original line number Diff line number Diff line
@@ -1167,6 +1167,10 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr, 
{

    VMXNET3State *s = opaque;



    if (!s->device_active) {

        return;

    }



    if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_TXPROD,

                        VMXNET3_DEVICE_MAX_TX_QUEUES, VMXNET3_REG_ALIGN)) {

        int tx_queue_idx =