[qemu-xen stable-4.18] hw/net/vmxnet3: Fix guest-triggerable assert()

[patchbot@xxxxxxx]

commit c68b844d3376764240afdb3c55d451e4dac11004
Author:     Thomas Huth <thuth@xxxxxxxxxx>
AuthorDate: Thu Aug 17 14:56:00 2023 +0200
Commit:     Michael Tokarev <mjt@xxxxxxxxxx>
CommitDate: Sun Sep 10 19:40:11 2023 +0300

    hw/net/vmxnet3: Fix guest-triggerable assert()
    
    The assert() that checks for valid MTU sizes can be triggered by
    the guest (e.g. with the reproducer code from the bug ticket
    https://gitlab.com/qemu-project/qemu/-/issues/517 ). Let's avoid
    this problem by simply logging the error and refusing to activate
    the device instead.
    
    Fixes: d05dcd94ae ("net: vmxnet3: validate configuration values during 
activate")
    Signed-off-by: Thomas Huth <thuth@xxxxxxxxxx>
    Cc: qemu-stable@xxxxxxxxxx
    Reviewed-by: Philippe Mathieu-Daudé <philmd@xxxxxxxxxx>
    Signed-off-by: Michael Tokarev <mjt@xxxxxxxxxx>
    [Mjt: change format specifier from %d to %u for uint32_t argument]
    (cherry picked from commit 90a0778421acdf4ca903be64c8ed19378183c944)
    Signed-off-by: Michael Tokarev <mjt@xxxxxxxxxx>
---
 hw/net/vmxnet3.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index cb52db96a2..fd3b9aff5b 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -1439,7 +1439,10 @@ static void vmxnet3_activate_device(VMXNET3State *s)
     vmxnet3_setup_rx_filtering(s);
     /* Cache fields from shared memory */
     s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
-    assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu <= VMXNET3_MAX_MTU);
+    if (s->mtu < VMXNET3_MIN_MTU || s->mtu > VMXNET3_MAX_MTU) {
+        qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Bad MTU size: %u\n", s->mtu);
+        return;
+    }
     VMW_CFPRN("MTU is %u", s->mtu);
 
     s->max_rx_frags =
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.18