[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [PATCH] xen-netfront: drop skb when skb->len > 65535

On Fri, 2013-03-01 at 17:00 +0000, Wei Liu wrote:
> On Fri, 2013-03-01 at 16:48 +0000, Jan Beulich wrote:
> > >>> On 01.03.13 at 17:31, Wei Liu <wei.liu2@xxxxxxxxxx> wrote:
> > > The `size' field of Xen network wired format is uint16_t, anything bigger 
> > > than
> > > 65535 will cause overflow.
> > > 
> > > The punishment introduced by XSA-39 is quite harsh - DomU is disconnected 
> > > when
> > > it's discovered to be sending corrupted skbs. However, it looks like Linux
> > > kernel will generate some bad skbs sometimes, so drop those skbs before
> > > sending to over netback to avoid being disconnected.
> > 
> > While fixing the frontend is certainly desirable, we can't expect
> > everyone to deploy fixed netfronts in all their VMs - some OS
> > versions used in there may even be out of service. So we
> > ought to find a way to also more gracefully deal with the
> > situation in netback, without re-opening the security issue
> > that prompted those changes.
> > 
> Regarding the punishment bit, I think its worth discussing it a bit.

Yes, the trick is figuring out what to do without reintroducing the
softlockup which XSA-39 fixed.

Perhaps we should allow silently consume (and drop) oversize skbs and
only shutdown the rings if they also consume too many (FSVO too many)

> But the bug is always there, it drew no attention until revealed by
> XSA-39. It ought to be fixed anyway. :-)

I would have sworn that skb->len was also limited to 64k, but looking at
the header I see it is actually an int and the only limit of that sort
is related to MAX_SKB_FRAGS (which doesn't actually limit the total

OOI how big were the skbs you were seeing?

Not that it really matters but do we have a handle on why the prexisting
bug didn't already cause connectivity issues? Does the retransmit (which
I suppose must be happening) somehow end up using a smaller skb size?

BTW you mean "wire protocol" not "wired protocol" in the comments etc.


Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.