Changeset 100883 in vbox for trunk/src/VBox/Devices

Timestamp:

Aug 16, 2023 11:39:26 AM (16 months ago)

Author:

vboxsync

Message:

Devices/Network/DevVirtioNet: Fix support for VLANs due to wrong size and ID checks, ticketref:21778

File:

• trunk/src/VBox/Devices/Network/DevVirtioNet.cpp (modified) (4 diffs)

trunk/src/VBox/Devices/Network/DevVirtioNet.cpp

@@ -2373 +2373 @@
         case VIRTIONET_CTRL_MQ_VQ_PAIRS_SET:
         {
-            size_t cbRemaining = pVirtqBuf->cbPhysSend - sizeof(*pCtrlPktHdr);
+            size_t cbRemaining = pVirtqBuf->cbPhysSend;
 
             AssertMsgReturn(cbRemaining > sizeof(cVirtqPairs),
@@ -2425 +2425 @@
 
     uint16_t uVlanId;
-    size_t cbRemaining = pVirtqBuf->cbPhysSend - sizeof(*pCtrlPktHdr);
-
-    AssertMsgReturn(cbRemaining > sizeof(uVlanId),
+    size_t cbRemaining = pVirtqBuf->cbPhysSend;
+
+    AssertMsgReturn(cbRemaining >= sizeof(uVlanId),
         ("DESC chain too small for VIRTIONET_CTRL_VLAN cmd processing"), VIRTIONET_ERROR);
 
@@ -2433 +2433 @@
     virtioCoreR3VirtqBufDrain(&pThis->Virtio, pVirtqBuf, &uVlanId, sizeof(uVlanId));
 
-    AssertMsgReturn(uVlanId > VIRTIONET_MAX_VLAN_ID,
+    AssertMsgReturn(uVlanId < VIRTIONET_MAX_VLAN_ID,
         ("%s VLAN ID out of range (VLAN ID=%u)\n", pThis->szInst, uVlanId), VIRTIONET_ERROR);
 
@@ -2492 +2492 @@
      * Allocate buffer and read in the control command
      */
-    AssertMsgReturnVoid(pVirtqBuf->cbPhysSend >= sizeof(VIRTIONET_CTRL_HDR_T),
-                        ("DESC chain too small for CTRL pkt header"));
-
     VIRTIONET_CTRL_HDR_T CtrlPktHdr; RT_ZERO(CtrlPktHdr);
-    virtioCoreR3VirtqBufDrain(&pThis->Virtio, pVirtqBuf, &CtrlPktHdr,
-                              RT_MIN(pVirtqBuf->cbPhysSend, sizeof(CtrlPktHdr)));
+    AssertLogRelMsgReturnVoid(pVirtqBuf->cbPhysSend >= sizeof(CtrlPktHdr),
+                              ("DESC chain too small for CTRL pkt header"));
+    virtioCoreR3VirtqBufDrain(&pThis->Virtio, pVirtqBuf, &CtrlPktHdr, sizeof(CtrlPktHdr));
 
     Log7Func(("[%s] CTRL COMMAND: class=%d command=%d\n", pThis->szInst, CtrlPktHdr.uClass, CtrlPktHdr.uCmd));