On 7/3/25 1:55 PM, Vladimir Sementsov-Ogievskiy wrote:
Theoretically tap_read_packet() may return size less than s->host_vnet_hdr_len, and next, we'll work with negative size (in case of !s->using_vnet_hdr). Let's avoid it. Signed-off-by: Vladimir Sementsov-Ogievskiy <vsement...@yandex-team.ru> --- net/tap.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/tap.c b/net/tap.c index ae1c7e39832..20d0dc2eb35 100644 --- a/net/tap.c +++ b/net/tap.c @@ -172,6 +172,11 @@ static void tap_send(void *opaque) break; }+ if (s->host_vnet_hdr_len && size < s->host_vnet_hdr_len) {+ /* Invalid packet */ + break; + } + if (s->host_vnet_hdr_len && !s->using_vnet_hdr) { buf += s->host_vnet_hdr_len; size -= s->host_vnet_hdr_len;
Reviewed-by: Daniil Tatianin <d-tatia...@yandex-team.ru>
