On Thu, Jul 3, 2025 at 10:59 PM Daniil Tatianin
<d-tatia...@yandex-team.ru> wrote:
>
> On 7/3/25 1:55 PM, Vladimir Sementsov-Ogievskiy wrote:
>
> > Theoretically tap_read_packet() may return size less than
> > s->host_vnet_hdr_len, and next, we'll work with negative size
> > (in case of !s->using_vnet_hdr). Let's avoid it.
> >
> > Signed-off-by: Vladimir Sementsov-Ogievskiy <vsement...@yandex-team.ru>
> > ---
> > net/tap.c | 5 +++++
> > 1 file changed, 5 insertions(+)
> >
> > diff --git a/net/tap.c b/net/tap.c
> > index ae1c7e39832..20d0dc2eb35 100644
> > --- a/net/tap.c
> > +++ b/net/tap.c
> > @@ -172,6 +172,11 @@ static void tap_send(void *opaque)
> > break;
> > }
> >
> > + if (s->host_vnet_hdr_len && size < s->host_vnet_hdr_len) {
> > + /* Invalid packet */
> > + break;
> > + }
> > +
> > if (s->host_vnet_hdr_len && !s->using_vnet_hdr) {
> > buf += s->host_vnet_hdr_len;
> > size -= s->host_vnet_hdr_len;
>
> Reviewed-by: Daniil Tatianin <d-tatia...@yandex-team.ru>
Queued.
Thanks
>
>
