yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch

05bba0
From 41ff6215085ee4118cad53b590be957143161f96 Mon Sep 17 00:00:00 2001
b2d9fb
From: Stefan Hajnoczi <stefanha@redhat.com>
b2d9fb
Date: Fri, 31 Jul 2015 15:59:46 +0200
05bba0
Subject: [PATCH 11/13] rtl8139: check IP Total Length field (CVE-2015-5165)
b2d9fb
b2d9fb
Message-id: <1438358388-10575-6-git-send-email-stefanha@redhat.com>
b2d9fb
Patchwork-id: 67240
b2d9fb
O-Subject: [RHEL-7.1.z qemu-kvm EMBARGOED PATCH 5/7] rtl8139: check IP Total Length field (CVE-2015-5165)
05bba0
Bugzilla: 1248766
b2d9fb
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
b2d9fb
RH-Acked-by: Xiao Wang <jasowang@redhat.com>
b2d9fb
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
b2d9fb
b2d9fb
The IP Total Length field includes the IP header and data.  Make sure it
b2d9fb
is valid and does not exceed the Ethernet payload size.
b2d9fb
b2d9fb
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
b2d9fb
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
b2d9fb
---
b2d9fb
 hw/net/rtl8139.c | 7 ++++++-
b2d9fb
 1 file changed, 6 insertions(+), 1 deletion(-)
b2d9fb
b2d9fb
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
b2d9fb
index 7efc0b5..61bc34c 100644
b2d9fb
--- a/hw/net/rtl8139.c
b2d9fb
+++ b/hw/net/rtl8139.c
b2d9fb
@@ -2183,7 +2183,12 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
b2d9fb
             }
b2d9fb
 
b2d9fb
             ip_protocol = ip->ip_p;
b2d9fb
-            ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
b2d9fb
+
b2d9fb
+            ip_data_len = be16_to_cpu(ip->ip_len);
b2d9fb
+            if (ip_data_len < hlen || ip_data_len > eth_payload_len) {
b2d9fb
+                goto skip_offload;
b2d9fb
+            }
b2d9fb
+            ip_data_len -= hlen;
b2d9fb
 
b2d9fb
             if (txdw0 & CP_TX_IPCS)
b2d9fb
             {
b2d9fb
-- 
b2d9fb
1.8.3.1
b2d9fb