Michael S. Tsirkin d7f053652f cadence_gem: fix buffer overflow ...

gem_transmit copies a packet from guest into an tx_packet[2048]
array on stack, with size limited by descriptor length set by guest.  If
guest is malicious and specifies a descriptor length that is too large,
and should packet size exceed array size, this results in a buffer
overflow.

Reported-by: 刘令 <liuling-it@360.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>

2016-02-04 13:22:06 +08:00

..

9pfs

9pfs: Clean up includes

2016-01-29 15:07:23 +00:00

acpi

x86: Clean up includes

2016-01-29 15:07:22 +00:00

alpha

alpha: Clean up includes

2016-01-29 15:07:23 +00:00

arm

hw/arm/virt: Add always-on property to the virt board timer

2016-01-21 14:15:07 +00:00

audio

audio: Clean up includes

2016-02-02 13:57:31 +01:00

block

virtio-blk: Functions for op blocker management

2016-02-02 17:50:46 +01:00

bt

hw: Clean up includes

2016-01-29 15:07:25 +00:00

char

hw: Clean up includes

2016-01-29 15:07:25 +00:00

core

hw/core: Clean up includes

2016-01-29 15:07:25 +00:00

cpu

hw: Clean up includes

2016-01-29 15:07:25 +00:00

cris

cris: Clean up includes

2016-01-29 15:07:24 +00:00

display

virtio-gpu: block any rendering until client (ui) is done

2016-02-03 10:41:36 +01:00

dma

hw: Clean up includes

2016-01-29 15:07:25 +00:00

gpio

hw: Clean up includes

2016-01-29 15:07:25 +00:00

i2c

hw: Clean up includes

2016-01-29 15:07:25 +00:00

i386

x86: Clean up includes

2016-01-29 15:07:22 +00:00

ide

macio: add dma_active to VMStateDescription

2016-01-30 23:37:36 +11:00

input

hw: Clean up includes

2016-01-29 15:07:25 +00:00

intc

hw/intc: Clean up includes

2016-01-29 15:07:24 +00:00

ipack

hw: Clean up includes

2016-01-29 15:07:25 +00:00

ipmi

hw: Clean up includes

2016-01-29 15:07:25 +00:00

isa

hw: Clean up includes

2016-01-29 15:07:25 +00:00

lm32

lm32: Clean up includes

2016-01-29 15:07:22 +00:00

m68k

m68k: Clean up includes

2016-01-29 15:07:24 +00:00

mem

hw: Clean up includes

2016-01-29 15:07:25 +00:00

microblaze

microblaze: Clean up includes

2016-01-28 11:13:13 +00:00

mips

mips: Clean up includes

2016-01-23 14:30:04 +00:00

misc

ivshmem: use a single eventfd callback, get rid of CharDriver

2016-02-02 13:28:58 +01:00

moxie

moxie: Clean up includes

2016-01-29 15:07:25 +00:00

net

cadence_gem: fix buffer overflow

2016-02-04 13:22:06 +08:00

nvram

hw: Clean up includes

2016-01-29 15:07:25 +00:00

openrisc

openrisc: Clean up includes

2016-01-29 15:07:24 +00:00

pci

pci: Clean up includes

2016-01-29 15:07:24 +00:00

pci-bridge

pci: Clean up includes

2016-01-29 15:07:24 +00:00

pci-host

uninorth.c: add support for UniNorth kMacRISCPCIAddressSelect (0x48) register

2016-01-30 23:37:38 +11:00

pcmcia

hw: Clean up includes

2016-01-29 15:07:25 +00:00

ppc

target-ppc: Helper to determine page size information from hpte alone

2016-01-30 23:49:27 +11:00

s390x

s390: Clean up includes

2016-01-29 15:07:22 +00:00

scsi

virtio-scsi: Catch BDS-BB removal/insertion

2016-02-02 17:50:46 +01:00

sd

hw: Clean up includes

2016-01-29 15:07:25 +00:00

sh4

sh4: Clean up includes

2016-01-29 15:07:24 +00:00

smbios

hw: Clean up includes

2016-01-29 15:07:25 +00:00

sparc

sparc: Clean up includes

2016-01-29 15:07:22 +00:00

sparc64

sparc: Clean up includes

2016-01-29 15:07:22 +00:00

ssi

hw: Clean up includes

2016-01-29 15:07:25 +00:00

timer

hw/timer: Clean up includes

2016-01-29 15:07:24 +00:00

tpm

hw: Clean up includes

2016-01-29 15:07:25 +00:00

tricore

tricore: Clean up includes

2016-01-29 15:07:25 +00:00

unicore32

unicore: Clean up includes

2016-01-29 15:07:22 +00:00

usb

ehci: update irq on reset

2016-02-02 14:11:01 +01:00

vfio

hw/vfio: Clean up includes

2016-01-29 15:07:24 +00:00

virtio

virtio: Clean up includes

2016-01-29 15:07:23 +00:00

watchdog

hw: Clean up includes

2016-01-29 15:07:25 +00:00

xen

xen: Clean up includes

2016-01-29 15:07:23 +00:00

xenpv

xen: Clean up includes

2016-01-29 15:07:23 +00:00

xtensa

xtensa: Clean up includes

2016-01-29 15:07:24 +00:00

Makefile.objs

Add a base IPMI interface

2015-12-22 18:39:19 +02:00