XSA-90

CVE-2014-2580

问题描述

http://xenbits.xen.org/xsa/advisory-90.html

Linux netback crash trying to disable due to malformed packet

When Linux’s netback sees a malformed packet, it tries to disable the interface which serves the misbehaving frontend.

This involves taking a mutex, which might sleep. But in recent versions of Linux the guest transmit path is handled by NAPI in softirq context, where sleeping is not allowed. The end result is that the backend domain (often, Dom0) crashes with scheduling while atomic.

在netback，如果发现一个恶意构造的packet，netback会尝试关闭和netfront交互的接口。这个操作涉及到获取一个mutex，造成sleep。然而在最近版本的guest网络路径中，是用NAPI来处理的，这个过程不允许sleep。因此backend的虚拟机（如Dom0）会crash（scheduling while atomic错误）

improper error handling (scheduling while atomic)

Patch描述

http://xenbits.xen.org/xsa/xsa90.patch

This patch does the following:

• introduce a flag to indicate the interface is disabled.
• check that flag in TX path, don’t do any work if it’s true.
• check that flag in RX path, turn off that interface if it’s true.

The reason to disable it in RX path is because RX uses kthread. After this change the behavior of netback is still consistent – it won’t do any TX work for a rogue frontend, and the interface will be eventually turned off.

Also change a continue to break after xenvif_fatal_tx_err, as it doesn’t make sense to continue processing packets if frontend is rogue.

从patch来看，在softirq context的时候不要disable interface，defer it in xenvif_kthred_guest_rx。

Consequence

Malicious guest administrators can cause denial of service. If driver domains are not in use, the impact is a host crash.

DoS