rx_desc_len is migrated as a raw uint8_t from the stream in both e1000e and igb, but it is a derived value that can be computed from the register state. A crafted migration stream can set rx_desc_len to an invalid value, causing a stack buffer overflow in e1000e_write_packet_to_guest() which copies rx_desc_len bytes into a 32-byte stack union.
Recalculate rx_desc_len from the register state in post_load, ignoring the untrusted value from the stream. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3869 v2: - extract e1000e_calc_rxconf() to recalculate all derived RX values - fix commit message to mention both RFCTL and RCTL - fix commit message to note that igb_rx_use_legacy_descriptor() is currently a stub Laurent Vivier (2): hw/net/e1000e: recalculate rx_desc_len on migration load hw/net/igb: recalculate rx_desc_len on migration load hw/net/e1000e_core.c | 18 +++++++++++++----- hw/net/igb_core.c | 2 ++ 2 files changed, 15 insertions(+), 5 deletions(-) -- 2.54.0
