qemu/include/net
Jason Wang 25c01bd19d net: drop too large packet early
We try to detect and drop too large packet (>INT_MAX) in 1592a99470
("net: ignore packet size greater than INT_MAX") during packet
delivering. Unfortunately, this is not sufficient as we may hit
another integer overflow when trying to queue such large packet in
qemu_net_queue_append_iov():

- size of the allocation may overflow on 32bit
- packet->size is integer which may overflow even on 64bit

Fixing this by moving the check to qemu_sendv_packet_async() which is
the entrance of all networking codes and reduce the limit to
NET_BUFSIZE to be more conservative. This works since:

- For the callers that call qemu_sendv_packet_async() directly, they
  only care about if zero is returned to determine whether to prevent
  the source from producing more packets. A callback will be triggered
  if peer can accept more then source could be enabled. This is
  usually used by high speed networking implementation like virtio-net
  or netmap.
- For the callers that call qemu_sendv_packet() that calls
  qemu_sendv_packet_async() indirectly, they often ignore the return
  value. In this case qemu will just the drop packets if peer can't
  receive.

Qemu will copy the packet if it was queued. So it was safe for both
kinds of the callers to assume the packet was sent.

Since we move the check from qemu_deliver_packet_iov() to
qemu_sendv_packet_async(), it would be safer to make
qemu_deliver_packet_iov() static to prevent any external user in the
future.

This is a revised patch of CVE-2018-17963.

Cc: qemu-stable@nongnu.org
Cc: Li Qiang <liq3ea@163.com>
Fixes: 1592a99470 ("net: ignore packet size greater than INT_MAX")
Reported-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20181204035347.6148-2-jasowang@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-12-04 11:06:15 +00:00
..
can_emu.h net/can: simple messages transport implementation for QEMU 2018-02-13 11:44:13 +01:00
can_host.h net/can: simple messages transport implementation for QEMU 2018-02-13 11:44:13 +01:00
checksum.h net: Transmit zero UDP checksum as 0xFFFF 2017-11-20 11:08:00 +08:00
eth.h net: fix misaligned member access 2018-03-02 18:44:00 +00:00
filter.h filter: Add handle_event method for NetFilterClass 2018-10-19 11:15:03 +08:00
net.h net: drop too large packet early 2018-12-04 11:06:15 +00:00
queue.h net/queue: export qemu_net_queue_append_iov 2015-10-12 13:31:18 +08:00
slirp.h net: Remove the deprecated -tftp, -bootp, -redir and -smb options 2018-08-31 09:53:03 +02:00
tap.h Drop superfluous includes of qapi-types.h and test-qapi-types.h 2018-02-09 05:05:11 +01:00
vhost-user.h Clean up ill-advised or unusual header guards 2016-07-12 16:20:46 +02:00
vhost_net.h tap: setting error appropriately when calling net_init_tap_one() 2018-03-05 10:30:16 +08:00