[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH 6/6] xen-netback: don't disconnect frontend when seeing oversize frame



Some buggy frontends may generate frames larger than 64 KiB. We should
aggresively consume all slots and drop the packet instead of disconnecting the
frontend.

Signed-off-by: David Vrabel <david.vrabel@xxxxxxxxxx>
Signed-off-by: Wei Liu <wei.liu2@xxxxxxxxxx>
---
 drivers/net/xen-netback/netback.c |   32 ++++++++++++++++++++++++++------
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c 
b/drivers/net/xen-netback/netback.c
index a634dc5..1971623 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -924,10 +924,12 @@ static void netbk_fatal_tx_err(struct xenvif *vif)
 static int netbk_count_requests(struct xenvif *vif,
                                struct xen_netif_tx_request *first,
                                struct xen_netif_tx_request *txp,
-                               int work_to_do)
+                               int work_to_do,
+                               RING_IDX first_idx)
 {
        RING_IDX cons = vif->tx.req_cons;
        int slots = 0;
+       bool drop = false;
 
        if (!(first->flags & XEN_NETTXF_more_data))
                return 0;
@@ -947,10 +949,21 @@ static int netbk_count_requests(struct xenvif *vif,
 
                memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + slots),
                       sizeof(*txp));
-               if (txp->size > first->size) {
-                       netdev_err(vif->dev, "Packet is bigger than frame.\n");
-                       netbk_fatal_tx_err(vif);
-                       return -EIO;
+
+               /* If the guest submitted a frame >= 64 KiB then
+                * first->size overflowed and following slots will
+                * appear to be larger than the frame.
+                *
+                * This cannot be fatal error as there are buggy
+                * frontends that do this.
+                *
+                * Consume all slots and drop the packet.
+                */
+               if (!drop && txp->size > first->size) {
+                       if (net_ratelimit())
+                               netdev_dbg(vif->dev,
+                                          "Packet is bigger than frame.\n");
+                       drop = true;
                }
 
                first->size -= txp->size;
@@ -963,6 +976,12 @@ static int netbk_count_requests(struct xenvif *vif,
                        return -EINVAL;
                }
        } while ((txp++)->flags & XEN_NETTXF_more_data);
+
+       if (drop) {
+               netbk_tx_err(vif, first, first_idx + slots);
+               return -EIO;
+       }
+
        return slots;
 }
 
@@ -1429,7 +1448,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk 
*netbk)
                                continue;
                }
 
-               ret = netbk_count_requests(vif, &txreq, txfrags, work_to_do);
+               ret = netbk_count_requests(vif, &txreq, txfrags,
+                                          work_to_do, idx);
                if (unlikely(ret < 0))
                        continue;
 
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.