debian/patches/extra/0002-net-vmxnet3-check-for-device_active-before-write.patch

   1 From 89636d45af75c102a7b893d8cc34a51be76e88b5 Mon Sep 17 00:00:00 2001
   2 From: Li Qiang <liqiang6-s@360.cn>
   3 Date: Mon, 8 Aug 2016 18:08:31 +0530
   4 Subject: [PATCH 2/5] net: vmxnet3: check for device_active before write
   5
   6 Vmxnet3 device emulator does not check if the device is active,
   7 before using it for write. It leads to a use after free issue,
   8 if the vmxnet3_io_bar0_write routine is called after the device is
   9 deactivated. Add check to avoid it.
  10
  11 Reported-by: Li Qiang <liqiang6-s@360.cn>
  12 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  13 Acked-by: Dmitry Fleytman <dmitry@daynix.com>
  14 Signed-off-by: Jason Wang <jasowang@redhat.com>
  15 ---
  16  hw/net/vmxnet3.c | 4 ++++
  17  1 file changed, 4 insertions(+)
  18
  19 diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
  20 index 20f26b7..a6ce16e 100644
  21 --- a/hw/net/vmxnet3.c
  22 +++ b/hw/net/vmxnet3.c
  23 @@ -1158,6 +1158,10 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr,
  24  {
  25      VMXNET3State *s = opaque;
  26
  27 +    if (!s->device_active) {
  28 +        return;
  29 +    }
  30 +
  31      if (VMW_IS_MULTIREG_ADDR(addr, VMXNET3_REG_TXPROD,
  32                          VMXNET3_DEVICE_MAX_TX_QUEUES, VMXNET3_REG_ALIGN)) {
  33          int tx_queue_idx =
  34 --
  35 2.1.4
  36