starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-04-05 22:00:58 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity

hw/net/rocker: Don't assume h_proto is aligned in eth_strip_vlan_ex()

Browse Source 
In eth_strip_vlan_ex() we take a pointer to the eth_header h_proto
field into a local uint16_t* variable, and then later in the function
we dereference that pointer.  This isn't safe, because the eth_header
struct may not be aligned, and if we mark the struct as QEMU_PACKED
then gcc will complain about taking the address of a field in a
packed struct.

Instead, make the local variable be a void* and use the appropriate
functions for accessing 16 bits of possibly unaligned data through
it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20260212140917.1443253-3-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
This commit is contained in:
Peter Maydell
2026-02-12 14:09:14 +00:00
committed by Philippe Mathieu-Daudé
parent 387ee5d2be
commit 3609630e79
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
net/eth.c
View File

@@ -274,7 +274,7 @@ eth_strip_vlan_ex(const struct iovec *iov, int iovcnt, size_t iovoff, int index,
uint16_t *payload_offset, uint16_t *tci)
{
struct vlan_header vlan_hdr;
uint16_t *new_ehdr_proto;
void *new_ehdr_proto;
size_t new_ehdr_size;
size_t copied;
@@ -298,7 +298,7 @@ eth_strip_vlan_ex(const struct iovec *iov, int iovcnt, size_t iovoff, int index,
return 0;
}
if (copied < new_ehdr_size || be16_to_cpu(*new_ehdr_proto) != vet) {
if (copied < new_ehdr_size || lduw_be_p(new_ehdr_proto) != vet) {
return 0;
}
@@ -308,7 +308,7 @@ eth_strip_vlan_ex(const struct iovec *iov, int iovcnt, size_t iovoff, int index,
return 0;
}
*new_ehdr_proto = vlan_hdr.h_proto;
stw_he_p(new_ehdr_proto, vlan_hdr.h_proto);
*payload_offset = iovoff + new_ehdr_size + sizeof(vlan_hdr);
*tci = be16_to_cpu(vlan_hdr.h_tci);