Re: [Xen-devel] [PATCH] xen-netfront: drop skb when skb->len > 65535

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 01.03.13 at 17:31, Wei Liu <wei.liu2@xxxxxxxxxx> wrote:
> The `size' field of Xen network wired format is uint16_t, anything bigger 
> than
> 65535 will cause overflow.
> 
> The punishment introduced by XSA-39 is quite harsh - DomU is disconnected when
> it's discovered to be sending corrupted skbs. However, it looks like Linux
> kernel will generate some bad skbs sometimes, so drop those skbs before
> sending to over netback to avoid being disconnected.

While fixing the frontend is certainly desirable, we can't expect
everyone to deploy fixed netfronts in all their VMs - some OS
versions used in there may even be out of service. So we
ought to find a way to also more gracefully deal with the
situation in netback, without re-opening the security issue
that prompted those changes.

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel