Commit eedeeeff authored by Shmulik Ladkani's avatar Shmulik Ladkani Committed by Jason Wang
Browse files

vmxnet3: Do not fill stats if device is inactive 



Guest OS may issue VMXNET3_CMD_GET_STATS even before device was
activated (for example in linux, after insmod but prior net-dev open).

Accessing shared descriptors prior device activation is illegal as the
VMXNET3State structures have not been fully initialized.

As a result, guest memory gets corrupted and may lead to guest OS
crashes.

Fix, by not filling the stats descriptors if device is inactive.

Reported-by: default avatarLeonid Shatz <leonid.shatz@ravellosystems.com>
Acked-by: default avatarDmitry Fleytman <dmitry@daynix.com>
Signed-off-by: default avatarDana Rubin <dana.rubin@ravellosystems.com>
Signed-off-by: default avatarShmulik Ladkani <shmulik.ladkani@ravellosystems.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
parent d3e0c032

hw/net/vmxnet3.c

+4 −0
Original line number Diff line number Diff line
@@ -1289,6 +1289,10 @@ static uint32_t vmxnet3_get_interrupt_config(VMXNET3State *s) 
static void vmxnet3_fill_stats(VMXNET3State *s)

{

    int i;



    if (!s->device_active)

        return;



    for (i = 0; i < s->txq_num; i++) {

        cpu_physical_memory_write(s->txq_descr[i].tx_stats_pa,

                                  &s->txq_descr[i].txq_stats,