On Wed, Dec 17, 2025 at 6:56 PM Michael Tokarev <[email protected]> wrote:
>
> On 10/28/25 19:00, Peter Maydell wrote:
> > In commits like 969e50b61a28 ("net: Pad short frames to minimum size
> > before sending from SLiRP/TAP") we switched away from requiring
> > network devices to handle short frames to instead having the net core
> > code do the padding of short frames out to the ETH_ZLEN minimum size.
> > We then dropped the code for handling short frames from the network
> > devices in a series of commits like 140eae9c8f7 ("hw/net: e1000:
> > Remove the logic of padding short frames in the receive path").
> >
> > This missed one route where the device's receive code can still see a
> > short frame: if the device is in loopback mode and it transmits a
> > short frame via the qemu_receive_packet() function, this will be fed
> > back into its own receive code without being padded.
> >
> > Add the padding logic to qemu_receive_packet().
> >
> > This fixes a buffer overrun which can be triggered in the
> > e1000_receive_iov() logic via the loopback code path.
> >
> > Other devices that use qemu_receive_packet() to implement loopback
> > are cadence_gem, dp8393x, lan9118, msf2-emac, pcnet, rtl8139
> > and sungem.
> >
> > Cc: [email protected]
> > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3043
> > Signed-off-by: Peter Maydell <[email protected]>
>
> Hi!
>
> Somehow I ended up picking up this change to all active-at-the-time
> qemu stable series, including 7.2.x. Without realizing the problem
> this change fixes does not exist in 7.2 to begin with - since commit
> 140eae9c8f7 is qemu 8.1, not 7.2.
>
> Am I right this change is harmful but not very useful for 7.2?
Yes, I think so.
Thanks
>
> Thanks,
>
> /mjt
>
> > ---
> > I think this is the right fix, but I'm not very familiar
> > with the net internals...
> > ---
> > net/net.c | 10 ++++++++++
> > 1 file changed, 10 insertions(+)
> >
> > diff --git a/net/net.c b/net/net.c
> > index 27e0d278071..8aefdb3424f 100644
> > --- a/net/net.c
> > +++ b/net/net.c
> > @@ -775,10 +775,20 @@ ssize_t qemu_send_packet(NetClientState *nc, const
> > uint8_t *buf, int size)
> >
> > ssize_t qemu_receive_packet(NetClientState *nc, const uint8_t *buf, int
> > size)
> > {
> > + uint8_t min_pkt[ETH_ZLEN];
> > + size_t min_pktsz = sizeof(min_pkt);
> > +
> > if (!qemu_can_receive_packet(nc)) {
> > return 0;
> > }
> >
> > + if (net_peer_needs_padding(nc)) {
> > + if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
> > + buf = min_pkt;
> > + size = min_pktsz;
> > + }
> > + }
> > +
> > return qemu_net_queue_receive(nc->incoming_queue, buf, size);
> > }
> >
>
