From eedeeeffd419ab149e0b0ad5fc4b7cf5e1db6274 Mon Sep 17 00:00:00 2001 From: Shmulik Ladkani Date: Thu, 15 Oct 2015 13:54:30 +0300 Subject: [PATCH] vmxnet3: Do not fill stats if device is inactive Guest OS may issue VMXNET3_CMD_GET_STATS even before device was activated (for example in linux, after insmod but prior net-dev open). Accessing shared descriptors prior device activation is illegal as the VMXNET3State structures have not been fully initialized. As a result, guest memory gets corrupted and may lead to guest OS crashes. Fix, by not filling the stats descriptors if device is inactive. Reported-by: Leonid Shatz Acked-by: Dmitry Fleytman Signed-off-by: Dana Rubin Signed-off-by: Shmulik Ladkani Signed-off-by: Jason Wang --- hw/net/vmxnet3.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index 3c5e10d..5e3a233 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1289,6 +1289,10 @@ static uint32_t vmxnet3_get_interrupt_config(VMXNET3State *s) static void vmxnet3_fill_stats(VMXNET3State *s) { int i; + + if (!s->device_active) + return; + for (i = 0; i < s->txq_num; i++) { cpu_physical_memory_write(s->txq_descr[i].tx_stats_pa, &s->txq_descr[i].txq_stats, -- 2.7.4