[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-commits] [qemu/qemu] 25c01b: net: drop too large packet early
From: |
GitHub |
Subject: |
[Qemu-commits] [qemu/qemu] 25c01b: net: drop too large packet early |
Date: |
Tue, 04 Dec 2018 03:40:29 -0800 |
Branch: refs/heads/master
Home: https://github.com/qemu/qemu
Commit: 25c01bd19d0e4b66f357618aeefda1ef7a41e21a
https://github.com/qemu/qemu/commit/25c01bd19d0e4b66f357618aeefda1ef7a41e21a
Author: Jason Wang <address@hidden>
Date: 2018-12-04 (Tue, 04 Dec 2018)
Changed paths:
M include/net/net.h
M net/net.c
Log Message:
-----------
net: drop too large packet early
We try to detect and drop too large packet (>INT_MAX) in 1592a9947036
("net: ignore packet size greater than INT_MAX") during packet
delivering. Unfortunately, this is not sufficient as we may hit
another integer overflow when trying to queue such large packet in
qemu_net_queue_append_iov():
- size of the allocation may overflow on 32bit
- packet->size is integer which may overflow even on 64bit
Fixing this by moving the check to qemu_sendv_packet_async() which is
the entrance of all networking codes and reduce the limit to
NET_BUFSIZE to be more conservative. This works since:
- For the callers that call qemu_sendv_packet_async() directly, they
only care about if zero is returned to determine whether to prevent
the source from producing more packets. A callback will be triggered
if peer can accept more then source could be enabled. This is
usually used by high speed networking implementation like virtio-net
or netmap.
- For the callers that call qemu_sendv_packet() that calls
qemu_sendv_packet_async() indirectly, they often ignore the return
value. In this case qemu will just the drop packets if peer can't
receive.
Qemu will copy the packet if it was queued. So it was safe for both
kinds of the callers to assume the packet was sent.
Since we move the check from qemu_deliver_packet_iov() to
qemu_sendv_packet_async(), it would be safer to make
qemu_deliver_packet_iov() static to prevent any external user in the
future.
This is a revised patch of CVE-2018-17963.
Cc: address@hidden
Cc: Li Qiang <address@hidden>
Fixes: 1592a9947036 ("net: ignore packet size greater than INT_MAX")
Reported-by: Li Qiang <address@hidden>
Reviewed-by: Li Qiang <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
Reviewed-by: Thomas Huth <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
Commit: 56512e1dc1c6a00d37da09baa35981908fb9b5c7
https://github.com/qemu/qemu/commit/56512e1dc1c6a00d37da09baa35981908fb9b5c7
Author: Jason Wang <address@hidden>
Date: 2018-12-04 (Tue, 04 Dec 2018)
Changed paths:
M net/hub.c
Log Message:
-----------
net: hub: suppress warnings of no host network for qtest
If we want to qtest through hub, it would be much more simpler and
safer to configure the hub without host network. So silent this
warnings for qtest.
Signed-off-by: Jason Wang <address@hidden>
Reviewed-by: Thomas Huth <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
Commit: ae4c445c6f38a01504b7040b1e01a69945137b0c
https://github.com/qemu/qemu/commit/ae4c445c6f38a01504b7040b1e01a69945137b0c
Author: Jason Wang <address@hidden>
Date: 2018-12-04 (Tue, 04 Dec 2018)
Changed paths:
M tests/virtio-net-test.c
Log Message:
-----------
virtio-net-test: accept variable length argument in pci_test_start()
This allows flexibility to be reused for all kinds of command line
used by other tests.
Reviewed-by: Eric Blake <address@hidden>
Reviewed-by: Thomas Huth <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
Commit: 432a82d72720f71cb965b64836672f19d57ceedb
https://github.com/qemu/qemu/commit/432a82d72720f71cb965b64836672f19d57ceedb
Author: Jason Wang <address@hidden>
Date: 2018-12-04 (Tue, 04 Dec 2018)
Changed paths:
M tests/virtio-net-test.c
Log Message:
-----------
virtio-net-test: remove unused macro
Reviewed-by: Thomas Huth <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
Commit: 118cafff251318d16e1cfdef9cbf6b7d1e74cdb5
https://github.com/qemu/qemu/commit/118cafff251318d16e1cfdef9cbf6b7d1e74cdb5
Author: Jason Wang <address@hidden>
Date: 2018-12-04 (Tue, 04 Dec 2018)
Changed paths:
M tests/virtio-net-test.c
Log Message:
-----------
virtio-net-test: add large tx buffer test
This test tries to build a packet whose size is greater than INT_MAX
which tries to trigger integer overflow in qemu_net_queue_append_iov()
which may result OOB.
Signed-off-by: Jason Wang <address@hidden>
Reviewed-by: Thomas Huth <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
Compare: https://github.com/qemu/qemu/compare/933cc4bb3469...118cafff2513
**NOTE:** This service has been marked for deprecation:
https://developer.github.com/changes/2018-04-25-github-services-deprecation/
Functionality will be removed from GitHub.com on January 31st, 2019.
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-commits] [qemu/qemu] 25c01b: net: drop too large packet early,
GitHub <=