39134eb9d2
on invalid state load CVE-2013-4539-qemut-tsc210x-fix-buffer-overrun-on-invalid-state-load.patch - bsc#962632 - VUL-0: CVE-2015-1779: xen: vnc: insufficient resource limiting in VNC websockets decoder CVE-2015-1779-qemuu-limit-size-of-HTTP-headers-from-websockets-clients.patch CVE-2015-1779-qemuu-incrementally-decode-websocket-frames.patch - bsc#962642 - VUL-0: CVE-2013-4537: xen: ssi-sd: buffer overrun on invalid state load CVE-2013-4537-qemut-ssi-sd-fix-buffer-overrun-on-invalid-state-load.patch - bsc#962627 - VUL-0: CVE-2014-7815: xen: vnc: insufficient bits_per_pixel from the client sanitization CVE-2014-7815-qemut-vnc-sanitize-bits_per_pixel-from-the-client.patch - bsc#962335 - VUL-0: CVE-2013-4538: xen: ssd0323: fix buffer overun on invalid state CVE-2013-4538-qemut-ssd0323-fix-buffer-overun-on-invalid-state.patch - bsc#962360 - VUL-0: CVE-2015-7512: xen: net: pcnet: buffer overflow in non-loopback mode CVE-2015-7512-qemuu-net-pcnet-buffer-overflow-in-non-loopback-mode.patch CVE-2015-7512-qemut-net-pcnet-buffer-overflow-in-non-loopback-mode.patch - bsc#961692 - VUL-0: CVE-2016-1714: xen: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714-qemuu-fw_cfg-add-check-to-validate-current-entry-value.patch CVE-2016-1714-qemut-fw_cfg-add-check-to-validate-current-entry-value.patch - bsc#961358 - VUL-0: CVE-2015-8613: xen: qemu: scsi: stack based buffer overflow in megasas_ctrl_get_info OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=395
70 lines
2.8 KiB
Diff
70 lines
2.8 KiB
Diff
Subject: net/vmxnet3: Refine l2 header validation
|
|
From: Dana Rubin dana.rubin@ravellosystems.com Tue Aug 18 12:45:55 2015 +0300
|
|
Date: Mon Oct 12 13:19:29 2015 +0800:
|
|
Git: a7278b36fcab9af469563bd7b9dadebe2ae25e48
|
|
|
|
Validation of l2 header length assumed minimal packet size as
|
|
eth_header + 2 * vlan_header regardless of the actual protocol.
|
|
|
|
This caused crash for valid non-IP packets shorter than 22 bytes, as
|
|
'tx_pkt->packet_type' hasn't been assigned for such packets, and
|
|
'vmxnet3_on_tx_done_update_stats()' expects it to be properly set.
|
|
|
|
Refine header length validation in 'vmxnet_tx_pkt_parse_headers'.
|
|
Check its return value during packet processing flow.
|
|
|
|
As a side effect, in case IPv4 and IPv6 header validation failure,
|
|
corrupt packets will be dropped.
|
|
|
|
Signed-off-by: Dana Rubin <dana.rubin@ravellosystems.com>
|
|
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
|
|
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
|
|
|
Index: xen-4.6.0-testing/tools/qemu-xen-dir-remote/hw/net/vmxnet3.c
|
|
===================================================================
|
|
--- xen-4.6.0-testing.orig/tools/qemu-xen-dir-remote/hw/net/vmxnet3.c
|
|
+++ xen-4.6.0-testing/tools/qemu-xen-dir-remote/hw/net/vmxnet3.c
|
|
@@ -729,9 +729,7 @@ static void vmxnet3_process_tx_queue(VMXNET3State *s, int qidx)
|
|
}
|
|
|
|
if (txd.eop) {
|
|
- if (!s->skip_current_tx_pkt) {
|
|
- vmxnet_tx_pkt_parse(s->tx_pkt);
|
|
-
|
|
+ if (!s->skip_current_tx_pkt && vmxnet_tx_pkt_parse(s->tx_pkt)) {
|
|
if (s->needs_vlan) {
|
|
vmxnet_tx_pkt_setup_vlan_header(s->tx_pkt, s->tci);
|
|
}
|
|
Index: xen-4.6.0-testing/tools/qemu-xen-dir-remote/hw/net/vmxnet_tx_pkt.c
|
|
===================================================================
|
|
--- xen-4.6.0-testing.orig/tools/qemu-xen-dir-remote/hw/net/vmxnet_tx_pkt.c
|
|
+++ xen-4.6.0-testing/tools/qemu-xen-dir-remote/hw/net/vmxnet_tx_pkt.c
|
|
@@ -142,11 +142,24 @@ static bool vmxnet_tx_pkt_parse_headers(struct VmxnetTxPkt *pkt)
|
|
|
|
bytes_read = iov_to_buf(pkt->raw, pkt->raw_frags, 0, l2_hdr->iov_base,
|
|
ETH_MAX_L2_HDR_LEN);
|
|
- if (bytes_read < ETH_MAX_L2_HDR_LEN) {
|
|
+ if (bytes_read < sizeof(struct eth_header)) {
|
|
+ l2_hdr->iov_len = 0;
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ l2_hdr->iov_len = sizeof(struct eth_header);
|
|
+ switch (be16_to_cpu(PKT_GET_ETH_HDR(l2_hdr->iov_base)->h_proto)) {
|
|
+ case ETH_P_VLAN:
|
|
+ l2_hdr->iov_len += sizeof(struct vlan_header);
|
|
+ break;
|
|
+ case ETH_P_DVLAN:
|
|
+ l2_hdr->iov_len += 2 * sizeof(struct vlan_header);
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ if (bytes_read < l2_hdr->iov_len) {
|
|
l2_hdr->iov_len = 0;
|
|
return false;
|
|
- } else {
|
|
- l2_hdr->iov_len = eth_get_l2_hdr_length(l2_hdr->iov_base);
|
|
}
|
|
|
|
l3_proto = eth_get_l3_proto(l2_hdr->iov_base, l2_hdr->iov_len);
|