From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Wed, 15 Jul 2015 17:17:03 +0000 (+0100)
Subject: rtl8139: skip offload on short TCP header
X-Git-Tag: qemu-xen-4.4.3~2
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=209ea71214e4bc42efea4bfd5a963520830f2e4c;p=qemu-upstream-4.4-testing.git

rtl8139: skip offload on short TCP header

TCP Large Segment Offload accesses the TCP header in the packet.  If the
packet is too short we must not attempt to access header fields:

  tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
  int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
---

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 4507f594b..af96e7c2d 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -2220,6 +2220,11 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
 
             if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)
             {
+                /* Large enough for the TCP header? */
+                if (ip_data_len < sizeof(tcp_header)) {
+                    goto skip_offload;
+                }
+
                 int large_send_mss = (txdw0 >> 16) & CP_TC_LGSEN_MSS_MASK;
 
                 DPRINTF("+++ C+ mode offloaded task TSO MTU=%d IP data %d "