On Tue, 27 Oct 2026 at 17:46, Peter Maydell <[email protected]> wrote: > > The net core code design is that by default packets are padded out to > the ethernet frame minimum before being handed to a network device > model, unless that device explicitly opted in by setting do_not_pad. > This avoids a whole class of bugs where network device receive code > has to be very careful about handling short packets. > > However, at the moment we do this check manually in the network > backend code before it calls qemu_send_packet() or > qemu_send_packet_async(), and we forgot to do it in all backends. So > you get the padding for the slirp, tap and vmnet backends, but not > for the "minor" backends like 'passt', 'socket' and 'dgram', or if > you configure two network devices connected by an emulated hub. > > This series fixes this by moving the padding code to > qemu_send_packet()/qemu_sendv_packet(), so that it always happens > regardless of the backend. > > The main bug this is fixing is > https://gitlab.com/qemu-project/qemu/-/work_items/2362 > but it's been re-reported multiple times for various combinations > of network devices and backends. > > The whole series is cc stable because without the padding you can > provoke various bugs in different network device models.
This has now been assigned CVE-2026-118490. -- PMM
