[Xen-changelog] [qemu-upstream-unstable] rtl8139: skip offload on short TCP header

[patchbot@xxxxxxx]

commit 6d75b8f79bfaa352566147ea606ca4ea504992d2
Author:     Stefan Hajnoczi <stefanha@xxxxxxxxxx>
AuthorDate: Wed Jul 15 18:17:03 2015 +0100
Commit:     Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
CommitDate: Mon Aug 3 13:52:23 2015 +0000

    rtl8139: skip offload on short TCP header
    
    TCP Large Segment Offload accesses the TCP header in the packet.  If the
    packet is too short we must not attempt to access header fields:
    
      tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
      int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);
    
    Signed-off-by: Stefan Hajnoczi <stefanha@xxxxxxxxxx>
    Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
---
 hw/net/rtl8139.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index ed2b23b..c8f0df9 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -2224,6 +2224,11 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
 
             if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)
             {
+                /* Large enough for the TCP header? */
+                if (ip_data_len < sizeof(tcp_header)) {
+                    goto skip_offload;
+                }
+
                 int large_send_mss = (txdw0 >> 16) & CP_TC_LGSEN_MSS_MASK;
 
                 DPRINTF("+++ C+ mode offloaded task TSO MTU=%d IP data %d "
--
generated by git-patchbot for /home/xen/git/qemu-upstream-unstable.git

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog