qemu-irix/hw
Prasad J Pandit fe90bdc25b net: ne2000: check ring buffer control registers
Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
bytes to process network packets. Registers PSTART & PSTOP
define ring buffer size & location. Setting these registers
to invalid values could lead to infinite loop or OOB r/w
access issues. Add check to avoid it.

Reported-by: Yang Hongke <yanghongke@huawei.com>
Tested-by: Yang Hongke <yanghongke@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit 415ab35a44)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2016-03-17 16:34:56 -05:00
..
9pfs virtio-9p: use accessor to get thread_pool 2016-03-15 12:20:55 -05:00
acpi Fix memory leak on error 2015-11-26 14:27:52 +02:00
alpha
arm xlnx-ep108: Fix minimum RAM check 2015-11-24 14:12:15 +00:00
audio
block xen/blkif: Avoid double access to src->nr_segments 2016-03-15 12:20:17 -05:00
bt bt: avoid unintended sign extension 2015-12-04 09:39:55 +03:00
char
core q35: Check propery to determine if iommu is set 2015-11-17 15:41:13 +02:00
cpu
cris
display xenfb: avoid reading twice the same fields from the shared page 2016-03-15 12:20:35 -05:00
dma
gpio
i2c
i386 pc: Don't set hw_version on pc-*-2.5 2015-11-25 13:42:37 +02:00
ide atapi: Fix code indentation 2015-11-24 14:56:49 -05:00
input
intc hw/arm_gic: Correctly restore nested irq priority 2015-11-19 12:09:52 +00:00
ipack
isa
lm32
m68k
mem
microblaze
mips gt64xxx: fix decoding of ISD register 2015-12-04 09:39:55 +03:00
misc ivshmem: remove redundant assignment, fix crash with msi=off 2016-03-15 12:35:51 -05:00
moxie
net net: ne2000: check ring buffer control registers 2016-03-17 16:34:56 -05:00
nvram
openrisc
pci
pci-bridge
pci-host i440fx: print an error message if user tries to enable iommu 2015-11-17 15:41:13 +02:00
pcmcia
ppc spapr_drc: Change value of property "fdt" from null back to {} 2015-12-04 16:50:59 +11:00
s390x virtio: handle non-virtio-1-capable backend for ccw 2015-12-02 19:34:11 +02:00
scsi scsi: initialise info object with appropriate size 2016-03-15 12:21:11 -05:00
sd sd: Mark brittle abuse of blk_attach_dev() FIXME 2015-12-07 17:13:10 +00:00
sh4
smbios
sparc
sparc64
ssi
timer
tpm tpm: avoid clang shifting negative signed warning 2015-11-17 18:35:56 +08:00
tricore
unicore32
usb ehci: make idt processing more robust 2016-03-15 12:07:11 -05:00
vfio
virtio virtio-pci: Set the QEMU_PCI_CAP_EXPRESS capability early in its DeviceClass realize method 2015-12-02 21:51:33 +02:00
watchdog
xen
xenpv xen: fix usage of xc_domain_create in domain builder 2015-11-13 17:38:06 +00:00
xtensa
Makefile.objs