On Mon, Nov 12, 2012 at 4:37 AM, Jan Kiszka <jan.kis...@siemens.com> wrote: > On 2012-11-12 01:59, Nickolai Zeldovich wrote: >> LWIP can generate packets with a source of 0.0.0.0, which triggers an >> assertion failure in arp_table_add(). Instead of crashing, simply return >> to avoid adding an invalid ARP table entry. > > I would prefer to filter out such invalid packets at a different level. > Did you analyzed which path it takes through the stack?
The particular packet that crashed qemu for me was a gratuitous ARP, though it looks like all three calls to arp_table_add() in arp_input() can trigger this. Popping up one level, I'm not sure why arp_table_add() and arp_table_search() need a special case for 0.0.0.0/8 in the first place. I couldn't find any other code that assumes the ARP table cannot contain 0.0.0.0/8 entries. Would anything break if the check for 0.0.0.0/8 was removed from arp_table_add() and arp_table_search() altogether? Nickolai.
