rx_desc_len is migrated as a raw uint8_t from the stream but is a derived value. Currently igb_rx_use_legacy_descriptor() is a stub that always returns false, so rx_desc_len is always set to sizeof(union e1000_adv_rx_desc). Recalculate it in post_load to prevent a crafted migration stream from setting an invalid value.
Cc: [email protected] Signed-off-by: Laurent Vivier <[email protected]> --- hw/net/igb_core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/net/igb_core.c b/hw/net/igb_core.c index 45d8fd795b84..2a4883907353 100644 --- a/hw/net/igb_core.c +++ b/hw/net/igb_core.c @@ -4548,5 +4548,7 @@ igb_core_post_load(IGBCore *core) igb_intrmgr_resume(core); igb_autoneg_resume(core); + igb_calc_rxdesclen(core); + return 0; } -- 2.54.0
