Re: [Qemu-devel] [PATCH] slirp: Don't crash on packets from 0.0.0.0/8.

[Nickolai Zeldovich]

On Mon, Nov 12, 2012 at 4:37 AM, Jan Kiszka <address@hidden> wrote:
> On 2012-11-12 01:59, Nickolai Zeldovich wrote:
>> LWIP can generate packets with a source of 0.0.0.0, which triggers an
>> assertion failure in arp_table_add().  Instead of crashing, simply return
>> to avoid adding an invalid ARP table entry.
>
> I would prefer to filter out such invalid packets at a different level.
> Did you analyzed which path it takes through the stack?

The particular packet that crashed qemu for me was a gratuitous ARP,
though it looks like all three calls to arp_table_add() in arp_input()
can trigger this.

Popping up one level, I'm not sure why arp_table_add() and
arp_table_search() need a special case for 0.0.0.0/8 in the first
place.  I couldn't find any other code that assumes the ARP table
cannot contain 0.0.0.0/8 entries.  Would anything break if the check
for 0.0.0.0/8 was removed from arp_table_add() and arp_table_search()
altogether?

Nickolai.