fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

net/tap: drop too small packets

Browse source 
Theoretically tap_read_packet() may return size less than
s->host_vnet_hdr_len, and next, we'll work with negative size
(in case of !s->using_vnet_hdr). Let's avoid it.

Don't proceed with size == s->host_vnet_hdr_len as well in case
of !s->using_vnet_hdr, it doesn't make sense.

Tested-by: Lei Yang <leiyang@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Jason Wang <jasowang@redhat.com>
This commit is contained in:
Vladimir Sementsov-Ogievskiy 2025-07-16 10:28:53 +03:00 • committed by Jason Wang
parent e82989544e
commit 3f9f6299a1
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
net/tap.c
View file

@ -190,6 +190,11 @@ static void tap_send(void *opaque)
break;
}
if (s->host_vnet_hdr_len && size <= s->host_vnet_hdr_len) {
/* Invalid packet */
break;
}
if (s->host_vnet_hdr_len && !s->using_vnet_hdr) {
buf += s->host_vnet_hdr_len;
size -= s->host_vnet_hdr_len;