rtl8139: skip offload on short TCP header

TCP Large Segment Offload accesses the TCP header in the packet.  If the
packet is too short we must not attempt to access header fields:

  tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
  int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
[Backport to qemu-xen-tradition]
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index d49d6fa6028cb9763e0d70cd78499234bca73095..0bb45832159e625318ffd0380ac6e7e950b28aec 100644 (file)
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -2163,9 +2163,15 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
 
             if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)
             {
+
 #if defined (DEBUG_RTL8139)
                 int large_send_mss = (txdw0 >> 16) & CP_TC_LGSEN_MSS_MASK;
 #endif
+                /* Large enough for the TCP header? */
+                if (ip_data_len < sizeof(tcp_header)) {
+                    goto skip_offload;
+                }
+
                 DEBUG_PRINT(("RTL8139: +++ C+ mode offloaded task TSO MTU=%d IP data %d frame data %d specified MSS=%d\n",
                              ETH_MTU, ip_data_len, saved_size - ETH_HLEN, large_send_mss));