From f97d74a8d72938e559360aa39d8c707f57cbb953 Mon Sep 17 00:00:00 2001
From: Michael Contreras <michael@inetric.com>
Date: Sun, 2 Dec 2012 20:11:22 -0800
Subject: e1000: Discard packets that are too long if !SBP and !LPE
Bug-Debian: http://bugs.debian.org/696051
Comment: first half of the fix for CVE-2012-6075
Comment: see also e1000-discard-oversized-packets-based-on-SBP_LPE.patch
Comment: http://patchwork.ozlabs.org/patch/203291/
Comment: Michael Contreras:
Comment: Tested with linux guest. This error can potentially be exploited. At the very
Comment: least it can cause a DoS to a guest system, and in the worse case it could
Comment: allow remote code execution on the guest system with kernel level privilege.
Comment: Risk seems low, as the network would need to be configured to allow large
Comment: packets.

The e1000_receive function for the e1000 needs to discard packets longer than
1522 bytes if the SBP and LPE flags are disabled. The linux driver assumes
this behavior and allocates memory based on this assumption.

Signed-off-by: Michael Contreras <michael@inetric.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
(cherry picked from commit b0d9ffcd0251161c7c92f94804dcf599dfa3edeb)

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/e1000.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/e1000.c b/hw/e1000.c
index d3a15e5..e22ba3d 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -59,6 +59,9 @@ static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL);
 #define PNPMMIO_SIZE      0x20000
 #define MIN_BUF_SIZE      60 /* Min. octets in an ethernet frame sans FCS */
 
+/* this is the size past which hardware will drop packets when setting LPE=0 */
+#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
+
 /*
  * HW models:
  *  E1000_DEV_ID_82540EM works with Windows and Linux
@@ -795,6 +798,13 @@ e1000_receive(VLANClientState *nc, const uint8_t *buf, size_t size)
         size = sizeof(min_buf);
     }
 
+    /* Discard oversized packets if !LPE and !SBP. */
+    if (size > MAXIMUM_ETHERNET_VLAN_SIZE
+        && !(s->mac_reg[RCTL] & E1000_RCTL_LPE)
+        && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) {
+        return size;
+    }
+
     if (!receive_filter(s, buf, size))
         return size;
 
-- 
1.7.10.4