From 6d75b8f79bfaa352566147ea606ca4ea504992d2 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Wed, 15 Jul 2015 18:17:03 +0100 Subject: [PATCH] rtl8139: skip offload on short TCP header TCP Large Segment Offload accesses the TCP header in the packet. If the packet is too short we must not attempt to access header fields: tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen); int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr); Signed-off-by: Stefan Hajnoczi Signed-off-by: Stefano Stabellini --- hw/net/rtl8139.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c index ed2b23b90..c8f0df9ac 100644 --- a/hw/net/rtl8139.c +++ b/hw/net/rtl8139.c @@ -2224,6 +2224,11 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s) if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP) { + /* Large enough for the TCP header? */ + if (ip_data_len < sizeof(tcp_header)) { + goto skip_offload; + } + int large_send_mss = (txdw0 >> 16) & CP_TC_LGSEN_MSS_MASK; DPRINTF("+++ C+ mode offloaded task TSO MTU=%d IP data %d " -- 2.39.5