diff options
| author | Roger Pau Monne <roger.pau@citrix.com> | 2013-01-18 18:07:00 +0100 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2013-01-18 17:30:58 +0000 |
| commit | 72b0ec467593775da3253251cecdb84f4bb10b13 (patch) | |
| tree | a89257a64623365a072af5928bd8bcbb2ee514af /main/xen/xsa41b.patch | |
| parent | da422d63cf72f05137326de21e931e64108f9636 (diff) | |
| download | aports-72b0ec467593775da3253251cecdb84f4bb10b13.tar.bz2 aports-72b0ec467593775da3253251cecdb84f4bb10b13.tar.xz | |
xen: XSA-41 remaining patches
Some patches where not included in the original XSA, this are the
remaining ones (so far).
To be applied to edge and 2.5
Diffstat (limited to 'main/xen/xsa41b.patch')
| -rw-r--r-- | main/xen/xsa41b.patch | 67 |
1 files changed, 67 insertions, 0 deletions
diff --git a/main/xen/xsa41b.patch b/main/xen/xsa41b.patch new file mode 100644 index 0000000000..b599c2a5d5 --- /dev/null +++ b/main/xen/xsa41b.patch @@ -0,0 +1,67 @@ +From 70454385eeee6f0b3f7a9eddca9f7340b5060824 Mon Sep 17 00:00:00 2001 +From: Michael Contreras <michael@inetric.com> +Date: Thu, 17 Jan 2013 11:49:37 +0000 +Subject: [PATCH] e1000: Discard oversized packets based on SBP|LPE + +Discard packets longer than 16384 when !SBP to match the hardware behavior. + +upstream-commit-id: 2c0331f4f7d241995452b99afaf0aab00493334a +security-tags: XSA-41, CVE-2012-6075 +This is the second of two security fixes for XSA-41. + +Signed-off-by: Michael Contreras <michael@inetric.com> +Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> +--- +diff --git a/tools/qemu-xen/hw/e1000.c b/tools/qemu-xen/hw/e1000.c +index 37d207e..a5e67a8 100644 +--- a/tools/qemu-xen/hw/e1000.c ++++ b/tools/qemu-xen/hw/e1000.c +@@ -61,6 +61,8 @@ static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL); + + /* this is the size past which hardware will drop packets when setting LPE=0 */ + #define MAXIMUM_ETHERNET_VLAN_SIZE 1522 ++/* this is the size past which hardware will drop packets when setting LPE=1 */ ++#define MAXIMUM_ETHERNET_LPE_SIZE 16384 + + /* + * HW models: +@@ -697,8 +699,9 @@ e1000_receive(VLANClientState *nc, const uint8_t *buf, size_t size) + } + + /* Discard oversized packets if !LPE and !SBP. */ +- if (size > MAXIMUM_ETHERNET_VLAN_SIZE +- && !(s->mac_reg[RCTL] & E1000_RCTL_LPE) ++ if ((size > MAXIMUM_ETHERNET_LPE_SIZE || ++ (size > MAXIMUM_ETHERNET_VLAN_SIZE ++ && !(s->mac_reg[RCTL] & E1000_RCTL_LPE))) + && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) { + return size; + } +diff --git a/tools/qemu-xen-traditional/hw/e1000.c b/tools/qemu-xen-traditional/hw/e1000.c +index 37d207e..a5e67a8 100644 +--- a/tools/qemu-xen-traditional/hw/e1000.c ++++ b/tools/qemu-xen-traditional/hw/e1000.c +@@ -61,6 +61,8 @@ static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL); + + /* this is the size past which hardware will drop packets when setting LPE=0 */ + #define MAXIMUM_ETHERNET_VLAN_SIZE 1522 ++/* this is the size past which hardware will drop packets when setting LPE=1 */ ++#define MAXIMUM_ETHERNET_LPE_SIZE 16384 + + /* + * HW models: +@@ -697,8 +699,9 @@ e1000_receive(VLANClientState *nc, const uint8_t *buf, size_t size) + } + + /* Discard oversized packets if !LPE and !SBP. */ +- if (size > MAXIMUM_ETHERNET_VLAN_SIZE +- && !(s->mac_reg[RCTL] & E1000_RCTL_LPE) ++ if ((size > MAXIMUM_ETHERNET_LPE_SIZE || ++ (size > MAXIMUM_ETHERNET_VLAN_SIZE ++ && !(s->mac_reg[RCTL] & E1000_RCTL_LPE))) + && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) { + return size; + } +-- +1.7.2.5 + |