| commit | a7278b36fcab9af469563bd7b9dadebe2ae25e48 | |
| author | Dana Rubin <dana.rubin@ravellosystems.com> | |
| Tue, 18 Aug 2015 09:45:55 +0000 (18 12:45 +0300) | ||
| committer | Jason Wang <jasowang@redhat.com> | |
| Mon, 12 Oct 2015 05:19:29 +0000 (12 13:19 +0800) | ||
| tree | 72bd2dc6e6c9218fc4848682adf4bd1dc62b5994 | treesnapshot (tar.gz zip) |
| parent | 5fdb4671b08e0d1631447e81348b2b50a6b85bf7 | commitdiff |
net/vmxnet3: Refine l2 header validation
Validation of l2 header length assumed minimal packet size as
eth_header + 2 * vlan_header regardless of the actual protocol.
This caused crash for valid non-IP packets shorter than 22 bytes, as
'tx_pkt->packet_type' hasn't been assigned for such packets, and
'vmxnet3_on_tx_done_update_stats()' expects it to be properly set.
Refine header length validation in 'vmxnet_tx_pkt_parse_headers'.
Check its return value during packet processing flow.
As a side effect, in case IPv4 and IPv6 header validation failure,
corrupt packets will be dropped.
Signed-off-by: Dana Rubin <dana.rubin@ravellosystems.com>
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Validation of l2 header length assumed minimal packet size as
eth_header + 2 * vlan_header regardless of the actual protocol.
This caused crash for valid non-IP packets shorter than 22 bytes, as
'tx_pkt->packet_type' hasn't been assigned for such packets, and
'vmxnet3_on_tx_done_update_stats()' expects it to be properly set.
Refine header length validation in 'vmxnet_tx_pkt_parse_headers'.
Check its return value during packet processing flow.
As a side effect, in case IPv4 and IPv6 header validation failure,
corrupt packets will be dropped.
Signed-off-by: Dana Rubin <dana.rubin@ravellosystems.com>
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| hw/net/vmxnet3.c | diffblobblamehistory | |
| hw/net/vmxnet_tx_pkt.c | diffblobblamehistory |