Re: [PATCH for-5.2 14/19] ftgmac100: Fix integer overflow in ftgmac100_do_tx()

2020-08-18 Thread Cédric Le Goater
On 8/11/20 2:39 PM, Peter Maydell wrote: > On Thu, 6 Aug 2020 at 14:21, Cédric Le Goater wrote: >> >> When inserting the VLAN tag in packets, memmove() can generate an >> integer overflow for packets whose length is less than 12 bytes. >> >> Check length against the size of the ethernet header (14

Re: [PATCH for-5.2 14/19] ftgmac100: Fix integer overflow in ftgmac100_do_tx()

2020-08-11 Thread Peter Maydell
On Thu, 6 Aug 2020 at 14:21, Cédric Le Goater wrote: > > When inserting the VLAN tag in packets, memmove() can generate an > integer overflow for packets whose length is less than 12 bytes. > > Check length against the size of the ethernet header (14 bytes) to > avoid the crash and return FTGMAC10

Re: [PATCH for-5.2 14/19] ftgmac100: Fix integer overflow in ftgmac100_do_tx()

2020-08-11 Thread Mauro Matteo Cascella
On Mon, Aug 10, 2020 at 7:14 PM Cédric Le Goater wrote: > > On 8/10/20 3:43 PM, Mauro Matteo Cascella wrote: > > On Thu, Aug 6, 2020 at 3:21 PM Cédric Le Goater wrote: > >> > >> When inserting the VLAN tag in packets, memmove() can generate an > >> integer overflow for packets whose length is les

Re: [PATCH for-5.2 14/19] ftgmac100: Fix integer overflow in ftgmac100_do_tx()

2020-08-10 Thread Cédric Le Goater
On 8/10/20 3:43 PM, Mauro Matteo Cascella wrote: > On Thu, Aug 6, 2020 at 3:21 PM Cédric Le Goater wrote: >> >> When inserting the VLAN tag in packets, memmove() can generate an >> integer overflow for packets whose length is less than 12 bytes. >> >> Check length against the size of the ethernet

Re: [PATCH for-5.2 14/19] ftgmac100: Fix integer overflow in ftgmac100_do_tx()

2020-08-10 Thread Mauro Matteo Cascella
On Thu, Aug 6, 2020 at 3:21 PM Cédric Le Goater wrote: > > When inserting the VLAN tag in packets, memmove() can generate an > integer overflow for packets whose length is less than 12 bytes. > > Check length against the size of the ethernet header (14 bytes) to > avoid the crash and return FTGMAC

Re: [PATCH for-5.2 14/19] ftgmac100: Fix integer overflow in ftgmac100_do_tx()

2020-08-06 Thread Joel Stanley
On Thu, 6 Aug 2020 at 13:21, Cédric Le Goater wrote: > > When inserting the VLAN tag in packets, memmove() can generate an > integer overflow for packets whose length is less than 12 bytes. > > Check length against the size of the ethernet header (14 bytes) to > avoid the crash and return FTGMAC10

[PATCH for-5.2 14/19] ftgmac100: Fix integer overflow in ftgmac100_do_tx()

2020-08-06 Thread Cédric Le Goater
When inserting the VLAN tag in packets, memmove() can generate an integer overflow for packets whose length is less than 12 bytes. Check length against the size of the ethernet header (14 bytes) to avoid the crash and return FTGMAC100_INT_XPKT_LOST status. This seems like a good modeling choice ev