Re: [Xen-devel] [PATCH] xen-netfront: drop skb when skb->len > 65535

[Wei Liu <wei.liu2@xxxxxxxxxx>]

On Fri, 2013-03-01 at 16:48 +0000, Jan Beulich wrote:
> >>> On 01.03.13 at 17:31, Wei Liu <wei.liu2@xxxxxxxxxx> wrote:
> > The `size' field of Xen network wired format is uint16_t, anything bigger 
> > than
> > 65535 will cause overflow.
> > 
> > The punishment introduced by XSA-39 is quite harsh - DomU is disconnected 
> > when
> > it's discovered to be sending corrupted skbs. However, it looks like Linux
> > kernel will generate some bad skbs sometimes, so drop those skbs before
> > sending to over netback to avoid being disconnected.
> 
> While fixing the frontend is certainly desirable, we can't expect
> everyone to deploy fixed netfronts in all their VMs - some OS
> versions used in there may even be out of service. So we
> ought to find a way to also more gracefully deal with the
> situation in netback, without re-opening the security issue
> that prompted those changes.
> 

Regarding the punishment bit, I think its worth discussing it a bit.

But the bug is always there, it drew no attention until revealed by
XSA-39. It ought to be fixed anyway. :-)


Wei.

> Jan
> 



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel