On Tue, Mar 26, 2013 at 11:13:38AM +0000, David Vrabel wrote:

quoted

quoted

Separately, it may be sensible for the backend to drop packets with more
frags than max-slots-per-frame up to some threshold where anything more
is considered malicious (i.e., 1 - 18 slots is a valid packet, 19-20 are
dropped and 21 or more is a fatal error).

Why drop the packet when we are able to process it? Frontend cannot know
it has crossed the line anyway.

Because it's a change to the protocol and we do not want to do this for
a regression fix.

If I understand correctly the regression you talked about was introduced
by harsh punishment in XSA-39? If so, this is the patch you need to fix
that. Frontend only knows that it has connectivity or not. This patch
guarantee that the old netfront with larger MAX_SKB_FRAGS still see the
same thing from its point of view.  Netfront cannot know the
intermediate state between 18 and 20.

As a separate fix we can consider increasing the number of slots
per-packet once there is a mechanism to report this to the front end.

Sure, that's on my TODO list.


Wei.