On 2026/07/22 20:24, Laurent Vivier wrote:
rx_desc_len is migrated as a raw uint8_t from the stream in both
e1000e and igb, but it is a derived value that can be computed from
the register state. A crafted migration stream can set rx_desc_len
to an invalid value, causing a stack buffer overflow in
e1000e_write_packet_to_guest() which copies rx_desc_len bytes into
a 32-byte stack union.
Recalculate rx_desc_len from the register state in post_load,
ignoring the untrusted value from the stream.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3869>
v2:
- extract e1000e_calc_rxconf() to recalculate all derived RX values
- fix commit message to mention both RFCTL and RCTL
- fix commit message to note that igb_rx_use_legacy_descriptor()
is currently a stub
Laurent Vivier (2):
hw/net/e1000e: recalculate rx_desc_len on migration load
hw/net/igb: recalculate rx_desc_len on migration load
hw/net/e1000e_core.c | 18 +++++++++++++-----
hw/net/igb_core.c | 2 ++
2 files changed, 15 insertions(+), 5 deletions(-)
For the whole series,
Reviewed-by: Akihiko Odaki <[email protected]>
Regards,
Akihiko Odaki
