89 lines
3.3 KiB
Diff
89 lines
3.3 KiB
Diff
|
Subject: e1000: Discard packets that are too long if !SBP and !LPE
|
||
|
|
From: Michael Contreras michael@inetric.com Sun Dec 2 20:11:22 2012 -0800
|
||
|
|
Date: Wed Jan 16 14:12:40 2013 +0000:
|
||
|
|
Git: b4e9b8169dedc0bcf0d3abe07642f761ac70aeea
|
||
|
|
|
||
|
|
The e1000_receive function for the e1000 needs to discard packets longer than
|
||
|
|
1522 bytes if the SBP and LPE flags are disabled. The linux driver assumes
|
||
|
|
this behavior and allocates memory based on this assumption.
|
||
|
|
|
||
|
|
Signed-off-by: Michael Contreras <michael@inetric.com>
|
||
|
|
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
|
||
|
|
|
||
|
|
Subject: e1000: Discard oversized packets based on SBP|LPE
|
||
|
|
From: Michael Contreras <michael@inetric.com>
|
||
|
|
Date: Wed, 5 Dec 2012 18:31:30 +0000 (-0500)
|
||
|
|
|
||
|
|
e1000: Discard oversized packets based on SBP|LPE
|
||
|
|
|
||
|
|
Discard packets longer than 16384 when !SBP to match the hardware behavior.
|
||
|
|
|
||
|
|
Signed-off-by: Michael Contreras <michael@inetric.com>
|
||
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
||
|
|
|
||
|
|
[ This is a security vulnerability, CVE-2012-6075 / XSA-41. ]
|
||
|
|
(cherry picked from commit 4c2cae2a882db4d2a231b27b3b31a5bbec6dacbf)
|
||
|
|
|
||
|
|
Index: xen-4.2.1-testing/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
|
||
|
|
===================================================================
|
||
|
|
--- xen-4.2.1-testing.orig/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
|
||
|
|
+++ xen-4.2.1-testing/tools/qemu-xen-traditional-dir-remote/hw/e1000.c
|
||
|
|
@@ -55,6 +55,11 @@ static int debugflags = DBGBIT(TXERR) |
|
||
|
|
#define REG_IOADDR 0x0
|
||
|
|
#define REG_IODATA 0x4
|
||
|
|
|
||
|
|
+/* this is the size past which hardware will drop packets when setting LPE=0 */
|
||
|
|
+#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
|
||
|
|
+/* this is the size past which hardware will drop packets when setting LPE=1 */
|
||
|
|
+#define MAXIMUM_ETHERNET_LPE_SIZE 16384
|
||
|
|
+
|
||
|
|
/*
|
||
|
|
* HW models:
|
||
|
|
* E1000_DEV_ID_82540EM works with Windows and Linux
|
||
|
|
@@ -628,6 +633,14 @@ e1000_receive(void *opaque, const uint8_
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
+ /* Discard oversized packets if !LPE and !SBP. */
|
||
|
|
+ if ((size > MAXIMUM_ETHERNET_LPE_SIZE ||
|
||
|
|
+ (size > MAXIMUM_ETHERNET_VLAN_SIZE
|
||
|
|
+ && !(s->mac_reg[RCTL] & E1000_RCTL_LPE)))
|
||
|
|
+ && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) {
|
||
|
|
+ return;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
if (!receive_filter(s, buf, size))
|
||
|
|
return;
|
||
|
|
|
||
|
|
Index: xen-4.2.1-testing/tools/qemu-xen-dir-remote/hw/e1000.c
|
||
|
|
===================================================================
|
||
|
|
--- xen-4.2.1-testing.orig/tools/qemu-xen-dir-remote/hw/e1000.c
|
||
|
|
+++ xen-4.2.1-testing/tools/qemu-xen-dir-remote/hw/e1000.c
|
||
|
|
@@ -59,6 +59,11 @@ static int debugflags = DBGBIT(TXERR) |
|
||
|
|
#define PNPMMIO_SIZE 0x20000
|
||
|
|
#define MIN_BUF_SIZE 60 /* Min. octets in an ethernet frame sans FCS */
|
||
|
|
|
||
|
|
+/* this is the size past which hardware will drop packets when setting LPE=0 */
|
||
|
|
+#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
|
||
|
|
+/* this is the size past which hardware will drop packets when setting LPE=1 */
|
||
|
|
+#define MAXIMUM_ETHERNET_LPE_SIZE 16384
|
||
|
|
+
|
||
|
|
/*
|
||
|
|
* HW models:
|
||
|
|
* E1000_DEV_ID_82540EM works with Windows and Linux
|
||
|
|
@@ -693,6 +698,14 @@ e1000_receive(VLANClientState *nc, const
|
||
|
|
size = sizeof(min_buf);
|
||
|
|
}
|
||
|
|
|
||
|
|
+ /* Discard oversized packets if !LPE and !SBP. */
|
||
|
|
+ if ((size > MAXIMUM_ETHERNET_LPE_SIZE ||
|
||
|
|
+ (size > MAXIMUM_ETHERNET_VLAN_SIZE
|
||
|
|
+ && !(s->mac_reg[RCTL] & E1000_RCTL_LPE)))
|
||
|
|
+ && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) {
|
||
|
|
+ return size;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
if (!receive_filter(s, buf, size))
|
||
|
|
return size;
|
||
|
|
|