[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 01/14] net/vmxnet3: Refine l2 header validation
From: |
Jason Wang |
Subject: |
[Qemu-devel] [PULL 01/14] net/vmxnet3: Refine l2 header validation |
Date: |
Mon, 12 Oct 2015 16:17:03 +0800 |
From: Dana Rubin <address@hidden>
Validation of l2 header length assumed minimal packet size as
eth_header + 2 * vlan_header regardless of the actual protocol.
This caused crash for valid non-IP packets shorter than 22 bytes, as
'tx_pkt->packet_type' hasn't been assigned for such packets, and
'vmxnet3_on_tx_done_update_stats()' expects it to be properly set.
Refine header length validation in 'vmxnet_tx_pkt_parse_headers'.
Check its return value during packet processing flow.
As a side effect, in case IPv4 and IPv6 header validation failure,
corrupt packets will be dropped.
Signed-off-by: Dana Rubin <address@hidden>
Signed-off-by: Shmulik Ladkani <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
---
hw/net/vmxnet3.c | 4 +---
hw/net/vmxnet_tx_pkt.c | 19 ++++++++++++++++---
2 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 04159c8..48ced71 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -729,9 +729,7 @@ static void vmxnet3_process_tx_queue(VMXNET3State *s, int
qidx)
}
if (txd.eop) {
- if (!s->skip_current_tx_pkt) {
- vmxnet_tx_pkt_parse(s->tx_pkt);
-
+ if (!s->skip_current_tx_pkt && vmxnet_tx_pkt_parse(s->tx_pkt)) {
if (s->needs_vlan) {
vmxnet_tx_pkt_setup_vlan_header(s->tx_pkt, s->tci);
}
diff --git a/hw/net/vmxnet_tx_pkt.c b/hw/net/vmxnet_tx_pkt.c
index f7344c4..eb88ddf 100644
--- a/hw/net/vmxnet_tx_pkt.c
+++ b/hw/net/vmxnet_tx_pkt.c
@@ -142,11 +142,24 @@ static bool vmxnet_tx_pkt_parse_headers(struct
VmxnetTxPkt *pkt)
bytes_read = iov_to_buf(pkt->raw, pkt->raw_frags, 0, l2_hdr->iov_base,
ETH_MAX_L2_HDR_LEN);
- if (bytes_read < ETH_MAX_L2_HDR_LEN) {
+ if (bytes_read < sizeof(struct eth_header)) {
+ l2_hdr->iov_len = 0;
+ return false;
+ }
+
+ l2_hdr->iov_len = sizeof(struct eth_header);
+ switch (be16_to_cpu(PKT_GET_ETH_HDR(l2_hdr->iov_base)->h_proto)) {
+ case ETH_P_VLAN:
+ l2_hdr->iov_len += sizeof(struct vlan_header);
+ break;
+ case ETH_P_DVLAN:
+ l2_hdr->iov_len += 2 * sizeof(struct vlan_header);
+ break;
+ }
+
+ if (bytes_read < l2_hdr->iov_len) {
l2_hdr->iov_len = 0;
return false;
- } else {
- l2_hdr->iov_len = eth_get_l2_hdr_length(l2_hdr->iov_base);
}
l3_proto = eth_get_l3_proto(l2_hdr->iov_base, l2_hdr->iov_len);
--
2.1.4
- [Qemu-devel] [PULL 00/14] Net patches, Jason Wang, 2015/10/12
- [Qemu-devel] [PULL 01/14] net/vmxnet3: Refine l2 header validation,
Jason Wang <=
- [Qemu-devel] [PULL 03/14] e1000: use alias for default model, Jason Wang, 2015/10/12
- [Qemu-devel] [PULL 07/14] netfilter: hook packets before net queue send, Jason Wang, 2015/10/12
- [Qemu-devel] [PULL 09/14] net/queue: introduce NetQueueDeliverFunc, Jason Wang, 2015/10/12
- [Qemu-devel] [PULL 10/14] netfilter: add an API to pass the packet to next filter, Jason Wang, 2015/10/12
- [Qemu-devel] [PULL 13/14] netfilter: add a netbuffer filter, Jason Wang, 2015/10/12
- [Qemu-devel] [PULL 14/14] tests: add test cases for netfilter object, Jason Wang, 2015/10/12
- Re: [Qemu-devel] [PULL 00/14] Net patches, Peter Maydell, 2015/10/12
- [Qemu-devel] [PULL 02/14] vmxnet3: Support reading IMR registers on bar0, Jason Wang, 2015/10/15
- [Qemu-devel] [PULL 04/14] vmxnet3: Add support for VMXNET3_CMD_GET_ADAPTIVE_RING_INFO command, Jason Wang, 2015/10/15
- [Qemu-devel] [PULL 06/14] init/cleanup of netfilter object, Jason Wang, 2015/10/15