This patchset is a set of patches which try to make the common code
in net/eth.c and hw/net/net_{tx,rx}_pkt.c a bit more robust against
malicious packets with bogus offsets and similar problems. In theory
if other parts of the code are correctly checking offsets and sizes
to ensure they're within the packet before relying on them, this
should make no difference. But a defence-in-depth approach seems
like a good idea.
Two things in this are fixing demonstrable bugs:
* the "igb" network device's use of the SCTP checksum validation
function allowed a malicious packet to trigger a read off the end
of an iovec, likely triggering a segfault (patch 1, issue #4138)
* net_tx_pkt_build_vheader() could overflow a 16-bit field when
calculating the virt header length, and net_tx_tcp_fragment_init()
would trust that and attempt an extremely large allocation as a
result, triggering an abort() (patches 8 and 9, issue #3648)
Neither of those are security issues from QEMU's point of view,
because "igb" isn't covered under the virtualization use case and
"guest root can trigger self-denial-of-service" is also excluded.
The rest are just sanity-checking, mostly based on suggestions
from issue #4156.
The disclaimer here is that this hasn't had much testing beyond
"make check" and "make check-functional" plus "make sure virtio-net
isn't obviously completely broken", which I am pretty sure
do not exercise much of this code at all, especially not the
stuff about L3 and L4 and segment-offload. So I'm trusting the
net maintainers to have a more extensive testsuite.
thanks
-- PMM
Peter Maydell (11):
hw/net/net_rx_pkt: Handle bogus l4hdr_off when validating SCTP
checksum
net/eth.c: In eth_parse_ipv6_hdr(), fix check of input size
net/eth.c: In eth_get_protocols(), don't report SCTP header off end of
packet
net/eth.c: Check for undersized IPv4 headers in eth_get_protocols()
net/eth.c: Harden _eth_tcp_has_data() against short lengths
net/eth.c: Tighten size checks in eth_get_l3_proto()
include/net/eth.h: Make eth_get_l2_hdr_length_iov() check protocol
hw/net/net_tx_pkt: Sanity check GSO headers in
net_tx_pkt_build_vheader()
hw/net/net_tx_pkt: Sanity check virt hdr len in
net_tx_tcp_fragment_init
hw/net/net_tx_pkt: Sanity check L2+L3 header len in
net_tx_pkt_parse_headers()
hw/net/net_rx_pkt: Check for overflow in _net_rx_pkt_calc_l4_csum()
include/net/eth.h | 4 +++-
hw/net/net_rx_pkt.c | 22 ++++++++++++++--------
hw/net/net_tx_pkt.c | 20 ++++++++++++++++++--
net/eth.c | 39 ++++++++++++++++++++++++++++++---------
4 files changed, 65 insertions(+), 20 deletions(-)
--
2.43.0
