[PATCH 0/2] hw/net/rtl8139: fix vlan tag related bugs

This patchset fixes a couple of bugs in the rtl8139 device related
to its handling of vlan tags.

The first is one that showed up as
https://gitlab.com/qemu-project/qemu/-/work_items/3518 -- a guest
can send a carefully constructed packet to itself over loopback
(or receive on over the network) that makes the vlan tag extraction
code overread the packet buffer by 4 bytes, leaking that data into
the guest. This is a regression that we introduced when we moved
"pad short packets" from individual network devices into the core
net code. Bin and I had a discussion about this:
https://lore.kernel.org/qemu-devel/CAFEAcA_UhmCxJc16CHE=4ZR1+PA0=4-29=fEe+d+iUmhLTzpuQ@mail.gmail.com/
where we started off thinking that we should fix this in the core
net code, but after looking at the 802.1Q spec I think that it is
a bug in the rtl8139 code, and it shouldn't be trying to pad the
packet as much as it is. So patch 1 fixes this by dropping that
attempt at padding entirely, so we always write exactly what we
get from the net backend into the receive buffer.

Patch 2 fixes a bug that Bin pointed out during that conversation:
when we insert a vlan tag while sending a packet over loopback we
don't adjust the size that we pass to qemu_receive_packet(), so we
truncate the last 4 bytes of data.

Big disclaimer here: I have tested these with "make check" and
with the buffer-overrun repro case from the bug report, and with
a simple guest VM. But we don't seem to document how to set up
a guest which receives and handles vlan-tagged packets, so I have
no idea how to actually test that part.

I don't think we need to be in a tearing hurry to get these fixes
into git, so although I've tagged them for stable I'm expecting
to get them in after we re-open for 11.2 rather than trying to
squeeze them into 11.1 at this point.

thanks
-- PMM

Peter Maydell (2):
  hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets
  hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback

 hw/net/rtl8139.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

-- 
2.43.0