Skip to contentSkip to conversation

e1000: Discard oversized packets based on SBP|LPE

PATCH Applied Michael Contreras 4 participants 7 messages Dec 5, 2012 – Dec 30, 2012 1 message not in the archive

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Michael Contreras

author
#1 lore raw

PATCH 1/1 e1000: Discard oversized packets based on SBP|LPE

Discard packets longer than 16384 when !SBP to match the hardware behavior.

Signed-off-by Michael Contreras <[email protected]>
---
 hw/e1000.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
hw/e1000.c +5 -2
index 5537ad2..e772c8e 100644
@@ -61,6 +61,8 @@ static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL);
 
 /* this is the size past which hardware will drop packets when setting LPE=0 */
 #define MAXIMUM_ETHERNET_VLAN_SIZE 1522
+/* this is the size past which hardware will drop packets when setting LPE=1 */
+#define MAXIMUM_ETHERNET_LPE_SIZE 16384
 
 /*
  * HW models:

@@ -809,8 +811,9 @@ e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     }
 
     /* Discard oversized packets if !LPE and !SBP. */
-    if (size > MAXIMUM_ETHERNET_VLAN_SIZE
-        && !(s->mac_reg[RCTL] & E1000_RCTL_LPE)
+    if ((size > MAXIMUM_ETHERNET_LPE_SIZE ||
+        (size > MAXIMUM_ETHERNET_VLAN_SIZE
+        && !(s->mac_reg[RCTL] & E1000_RCTL_LPE)))
         && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) {
         return size;
     }
Signature · 1 line
1.8.0.1
#3 lore raw
Quoted 7 lines · Stefan Hajnoczi
Quoted 6 lines · Michael Contreras

Discard packets longer than 16384 when !SBP to match the hardware behavior.

Signed-off-by Michael Contreras <[email protected]>
---
 hw/e1000.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

It looks like another very good candidate for -stable (up to quite some releases of qemu ago), together with the previous similar patch.

Isn't it quite a bit security-sensitive too?

Thanks,

/mjt

#4 lore raw
Quoted 11 lines · Michael Tokarev
Quoted 7 lines · Stefan Hajnoczi
Quoted 6 lines · Michael Contreras

Discard packets longer than 16384 when !SBP to match the hardware behavior.

Signed-off-by Michael Contreras <[email protected]>
---
 hw/e1000.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

It looks like another very good candidate for -stable (up to quite some releases of qemu ago), together with the previous similar patch.

Yes, it's good for -stable.

Stefan

author
#5 lore raw
Quoted 10 lines · Stefan Hajnoczi
Quoted 9 lines · Michael Tokarev
Quoted 7 lines · Stefan Hajnoczi
Quoted 6 lines · Michael Contreras

Discard packets longer than 16384 when !SBP to match the hardware behavior.

Signed-off-by Michael Contreras <[email protected]>
---
 hw/e1000.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
Quoted 6 lines
Quoted 2 lines

It looks like another very good candidate for -stable (up to quite some releases of qemu ago), together with the previous similar patch.

Yes, it's good for -stable.

Stefan

Thanks guys. Any update on the CVE number? Seems the KVM qemu git tree still has this vulnerability. Xen has the fix in their qemu unstable git mirror, but hasn't applied it yet either.

Michael

#6 lore raw
Quoted 14 lines · Michael Contreras
Quoted 13 lines · Stefan Hajnoczi
Quoted 11 lines · Michael Tokarev
Quoted 7 lines · Stefan Hajnoczi
Quoted 6 lines · Michael Contreras

Discard packets longer than 16384 when !SBP to match the hardware behavior.

Signed-off-by Michael Contreras <[email protected]>
---
 hw/e1000.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

It looks like another very good candidate for -stable (up to quite some releases of qemu ago), together with the previous similar patch.

Quoted 7 lines
Quoted 3 lines

Yes, it's good for -stable.

Stefan

Thanks guys. Any update on the CVE number? Seems the KVM qemu git tree still has this vulnerability. Xen has the fix in their qemu unstable git mirror, but hasn't applied it yet either.

Your original LPE patch went into QEMU 1.3. qemu-kvm.git is no longer relevant - it has been merged back into qemu.git and has therefore not been updated since October 11. Use qemu.git.

Perhaps others can provide info on the CVE and Xen.

Stefan

#7 lore raw
In reply to Michael Contreras

18.12.2012 21:34, Michael Contreras пишет:

Quoted 14 lines · Stefan Hajnoczi
Quoted 13 lines · Michael Tokarev
Quoted 11 lines · Stefan Hajnoczi
Quoted 7 lines · Michael Contreras
Quoted 6 lines

Discard packets longer than 16384 when !SBP to match the hardware behavior.

Signed-off-by Michael Contreras <[email protected]>
---
  hw/e1000.c | 7 +++++--
  1 file changed, 5 insertions(+), 2 deletions(-)

It looks like another very good candidate for -stable (up to quite some releases of qemu ago), together with the previous similar patch.

Quoted 7 lines
Quoted 3 lines

Yes, it's good for -stable.

Stefan

Thanks guys. Any update on the CVE number? Seems the KVM qemu git tree still has this vulnerability. Xen has the fix in their qemu unstable git mirror, but hasn't applied it yet either.

This issue has been assigned CVE-2012-6075.

qemu-kvm does not exist anymore, it is just an internal development tree for qemu, sort of like a subsystem tree - there will be no more qemu-kvm releases.

So we care only about qemu (main, older versions, incl. 0.12 and 0.15, are also affected), old qemu-kvm, and xen. CC'ing afaerber for 0.15.

Thank you!

/mjt