[Xen-devel] [PATCH 7/7] xen-netback: don't disconnect frontend when seeing oversize packet

[Wei Liu <wei.liu2@xxxxxxxxxx>]

Some frontend drivers are sending packets > 64 KiB in length. This length
overflows the length field in the first slot making the following slots have
an invalid length ("Packet is bigger than frame").

Turn this error back into a non-fatal error by dropping the packet. To avoid
having the following slots having fatal errors, consume all slots in the
packet.

This does not reopen the security hole in XSA-39 as if the packet as an
invalid number of slots it will still hit fatal error case.

Signed-off-by: David Vrabel <david.vrabel@xxxxxxxxxx>
Signed-off-by: Wei Liu <wei.liu2@xxxxxxxxxx>
---
 drivers/net/xen-netback/netback.c |   19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/drivers/net/xen-netback/netback.c 
b/drivers/net/xen-netback/netback.c
index 3490b2c..acd057b 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -986,10 +986,21 @@ static int netbk_count_requests(struct xenvif *vif,
 
                memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + slots),
                       sizeof(*txp));
-               if (txp->size > first->size) {
-                       netdev_err(vif->dev, "Packet is bigger than frame.\n");
-                       netbk_fatal_tx_err(vif);
-                       return -EIO;
+
+               /* If the guest submitted a frame >= 64 KiB then
+                * first->size overflowed and following slots will
+                * appear to be larger than the frame.
+                *
+                * This cannot be fatal error as there are buggy
+                * frontends that do this.
+                *
+                * Consume all slots and drop the packet.
+                */
+               if (!drop_err && txp->size > first->size) {
+                       if (net_ratelimit())
+                               netdev_dbg(vif->dev,
+                                          "Packet is bigger than frame.\n");
+                       drop_err = -EIO;
                }
 
                first->size -= txp->size;
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel