Skip to content

Commit

Permalink
net: vmxnet: initialise local tx descriptor
Browse files Browse the repository at this point in the history
In Vmxnet3 device emulator while processing transmit(tx) queue,
when it reaches end of packet, it calls vmxnet3_complete_packet.
In that local 'txcq_descr' object is not initialised, which could
leak host memory bytes a guest.

Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Dmitry Fleytman <dmitry@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
  • Loading branch information
Li Qiang authored and jasowang committed Oct 26, 2016
1 parent c89d416 commit fdda170
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions hw/net/vmxnet3.c
Expand Up @@ -531,6 +531,7 @@ static void vmxnet3_complete_packet(VMXNET3State *s, int qidx, uint32_t tx_ridx)

VMXNET3_RING_DUMP(VMW_RIPRN, "TXC", qidx, &s->txq_descr[qidx].comp_ring);

memset(&txcq_descr, 0, sizeof(txcq_descr));
txcq_descr.txdIdx = tx_ridx;
txcq_descr.gen = vmxnet3_ring_curr_gen(&s->txq_descr[qidx].comp_ring);

Expand Down

0 comments on commit fdda170

Please sign in to comment.