Changeset 85146 in vbox

Timestamp:

Jul 9, 2020 10:20:38 AM (5 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

139093

Message:

Dev/E1000,PDM: (bugref:9764) disable UFO, UDP header checks, zero MSS handling.

Location:

trunk

Files:

• include/VBox/vmm/pdmnetinline.h (modified) (1 diff)
• src/VBox/Devices/Network/DevE1000.cpp (modified) (4 diffs)

trunk/include/VBox/vmm/pdmnetinline.h

@@ -542 +542 @@
         case PDMNETWORKGSOTYPE_IPV4_UDP:
             if (iSeg == 0)
+            {
+                if (pGso->offHdr2 + sizeof(RTNETUDP::uh_ulen) > cbFrame)
+                    return 0; /* Incomplete UDP header! */
+                /* uh_ulen cannot exceed cbFrame - pGso->offHdr2 (offset of UDP header) */
+                if ((unsigned)(pGso->offHdr2 + RT_BE2H_U16(((PCRTNETUDP)&pbFrame[pGso->offHdr2])->uh_ulen)) > cbFrame)
+                    if (cbFrame > UINT16_MAX)
+                        ((PRTNETUDP)&pbFrame[pGso->offHdr2])->uh_ulen = 0xFFFF;
+                    else
+                        ((PRTNETUDP)&pbFrame[pGso->offHdr2])->uh_ulen = RT_H2BE_U16((uint16_t)(cbFrame - pGso->offHdr2));
+                Assert((unsigned)(pGso->offHdr2 + ((PCRTNETUDP)&pbFrame[pGso->offHdr2])->uh_ulen) <= cbFrame);
                 pdmNetGsoUpdateUdpHdrUfo(RTNetIPv4PseudoChecksum((PRTNETIPV4)&pbFrame[pGso->offHdr1]),
                                          pbSegHdrs, pbFrame, pGso->offHdr2);
+            }
             pdmNetGsoUpdateIPv4HdrUfo(pbSegHdrs, pGso->offHdr1, cbSegPayload, iSeg * pGso->cbMaxSeg,
                                       cbSegHdrs, iSeg + 1 == cSegs);

trunk/src/VBox/Devices/Network/DevE1000.cpp

@@ -2474 +2474 @@
         }
         else
+        {
             status.fVP = false; /* Set VP only if we stripped the tag */
+            memcpy(rxPacket, pvBuf, cb);
+        }
     }
     else
@@ -3661 +3664 @@
     pGso->offHdr2  = pCtx->tu.u8CSS;
     pGso->cbHdrsTotal = pCtx->dw3.u8HDRLEN;
-    pGso->cbMaxSeg = pCtx->dw3.u16MSS;
+    pGso->cbMaxSeg = pCtx->dw3.u16MSS + (pGso->u8Type == PDMNETWORKGSOTYPE_IPV4_UDP ? pGso->offHdr2 : 0);
     Assert(PDMNetGsoIsValid(pGso, sizeof(*pGso), pGso->cbMaxSeg * 5));
     E1kLog2(("e1kSetupGsoCtx: mss=%#x hdr=%#x hdrseg=%#x hdr1=%#x hdr2=%#x %s\n",
@@ -4604 +4607 @@
              pThis->szPrf, cbFragment, pThis->u16TxPktLen, pTxSg->cbUsed, pTxSg->cbAvailable,
              fGso ? "true" : "false"));
+    PCPDMNETWORKGSO pGso = (PCPDMNETWORKGSO)pTxSg->pvUser;
+    if (pGso)
+    {
+        if (RT_UNLIKELY(pGso->cbMaxSeg == 0))
+        {
+            E1kLog(("%s zero-sized fragments are not allowed\n", pThis->szPrf));
+            return false;
+        }
+        if (RT_UNLIKELY(pGso->u8Type == PDMNETWORKGSOTYPE_IPV4_UDP))
+        {
+            E1kLog(("%s UDP fragmentation is no longer supported\n", pThis->szPrf));
+            return false;
+        }
+    }
     if (RT_UNLIKELY( !fGso && cbNewPkt > E1K_MAX_TX_PKT_SIZE ))
     {
@@ -5267 +5284 @@
             default:
                 AssertMsgFailed(("Impossible descriptor type!"));
+                continue;
         }
         if (pDesc->legacy.cmd.fEOP)