]>
Commit | Line | Data |
---|---|---|
68a30562 | 1 | From 1313d27fc347633d0cf6fc2ff8cbe17a740dd658 Mon Sep 17 00:00:00 2001 |
55c8f154 WB |
2 | From: Li Qiang <liqiang6-s@360.cn> |
3 | Date: Thu, 11 Aug 2016 00:42:20 +0530 | |
68a30562 | 4 | Subject: [PATCH 2/3] net: vmxnet: initialise local tx descriptor |
55c8f154 WB |
5 | |
6 | In Vmxnet3 device emulator while processing transmit(tx) queue, | |
7 | when it reaches end of packet, it calls vmxnet3_complete_packet. | |
8 | In that local 'txcq_descr' object is not initialised, which could | |
9 | leak host memory bytes a guest. | |
10 | ||
11 | Reported-by: Li Qiang <liqiang6-s@360.cn> | |
12 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | |
13 | --- | |
14 | hw/net/vmxnet3.c | 1 + | |
15 | 1 file changed, 1 insertion(+) | |
16 | ||
17 | diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c | |
68a30562 | 18 | index 90f6943..92f6af9 100644 |
55c8f154 WB |
19 | --- a/hw/net/vmxnet3.c |
20 | +++ b/hw/net/vmxnet3.c | |
68a30562 | 21 | @@ -531,6 +531,7 @@ static void vmxnet3_complete_packet(VMXNET3State *s, int qidx, uint32_t tx_ridx) |
55c8f154 WB |
22 | |
23 | VMXNET3_RING_DUMP(VMW_RIPRN, "TXC", qidx, &s->txq_descr[qidx].comp_ring); | |
24 | ||
25 | + memset(&txcq_descr, 0, sizeof(txcq_descr)); | |
26 | txcq_descr.txdIdx = tx_ridx; | |
27 | txcq_descr.gen = vmxnet3_ring_curr_gen(&s->txq_descr[qidx].comp_ring); | |
28 | ||
29 | -- | |
30 | 2.1.4 | |
31 |