HVM-845 QEMU e1000 DMA bounds check can be given the slip (CVE-2016-1981

)
TritonDataCenter · Feb 6, 2016 · c1a197c · c1a197c
1 parent b1f1e64
commit c1a197c
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/hw/e1000.c b/hw/e1000.c
@@ -549,7 +549,8 @@ start_xmit(E1000State *s)
          * bogus values to TDT/TDLEN.
          * there's nothing too intelligent we could do about this.
          */
-        if (s->mac_reg[TDH] == tdh_start) {
+        if (s->mac_reg[TDH] == tdh_start ||
+            tdh_start >= s->mac_reg[TDLEN] / sizeof(desc)) {
             DBGOUT(TXERR, "TDH wraparound @%x, TDT %x, TDLEN %x\n",
                    tdh_start, s->mac_reg[TDT], s->mac_reg[TDLEN]);
             break;
@@ -699,7 +700,8 @@ e1000_receive(VLANClientState *nc, const uint8_t *buf, size_t size)
             s->mac_reg[RDH] = 0;
         s->check_rxov = 1;
         /* see comment in start_xmit; same here */
-        if (s->mac_reg[RDH] == rdh_start) {
+        if (s->mac_reg[RDH] == rdh_start ||
+            rdh_start >= s->mac_reg[RDLEN] / sizeof(desc)) {
             DBGOUT(RXERR, "RDH wraparound @%x, RDT %x, RDLEN %x\n",
                    rdh_start, s->mac_reg[RDT], s->mac_reg[RDLEN]);
             set_ics(s, 0, E1000_ICS_RXO);