Subject: Re: query: bnx2 and tg3 don't check tcp and/or ip header length validity?

From: William Allen Simpson <[email-masked]>
Date: Wed, 14 Oct 2009 20:40:36 -0400

Michael Chan wrote:
> The option length is needed by the hardware to segment a TSO packet into
> proper MTU-sized packets.  You'll get malformed packets if the TSO
> header is bad.  Setting it to zero perhaps can make these bad packets
> more deterministic, but I don't know for sure.
> 
Malformed packets are unlikely (I'll use unlikely() on the test), but
I've seen a lot of unlikely things happen over the years.  When I was
concourse manager at Interop '91, a bad Portmaster build wouldn't pass
packets through one kind of router (3com); but it passed through all
the others!  Turned out, *most* routers didn't check the IP version
and IHL fields.  Shocking!

When we were designing IPv6 in '93, we had to use new IEEE numbers, etc.
(instead of the IP version and IHL) to distinguish the new version.
Otherwise, various printers crashed....

Unless there's a clearly documented check earlier in the code path (and
there's nothing documented here), always re-check everything.  (Also,
never forget cosmic radiation....)  Remember, from a driver developer's
perspective, the hardware always fails.  (And from a hardware viewpoint,
the software is always bad.)