diff options
| author | Linfeng Sun <linfeng.sun.dev@gmail.com> | 2026-09-01 17:48:42 +0800 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2026-09-03 11:25:01 -0400 |
| commit | 001e2c7b0c2ee0ca2ec0d17e92e28fa495a17cf9 (patch) | |
| tree | a4cdc57d3023e3683e9cbe82a649985532afe3ab | |
| parent | 54e19896cc6d934ad96125b0795d13fbdfcb9996 (diff) | |
| download | linux-next-001e2c7b0c2ee0ca2ec0d17e92e28fa495a17cf9.tar.gz linux-next-001e2c7b0c2ee0ca2ec0d17e92e28fa495a17cf9.zip | |
vdpa_sim_net: check TX pull result before RX copy
vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is
currently added to the unsigned byte counter and then passed as a size_t
length to receive_filter() and vringh_iov_push_iotlb(). A negative error
can therefore become a large length in the RX path.
Handle non-positive pull results before every length use. Count the TX
error and complete the consumed TX descriptor with zero bytes.
I found this bug myself, though the patch was written with AI assistance.
Fixes: cfe226892913 ("vdpa_sim: filter destination mac address")
Assisted-by: OpenAI-Codex:GPT-5
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260901094842.25875-1-linfeng.sun.dev@gmail.com>
| -rw-r--r-- | drivers/vdpa/vdpa_sim/vdpa_sim_net.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim_net.c b/drivers/vdpa/vdpa_sim/vdpa_sim_net.c index 29fd14ce5860..a6514b5ccd86 100644 --- a/drivers/vdpa/vdpa_sim/vdpa_sim_net.c +++ b/drivers/vdpa/vdpa_sim/vdpa_sim_net.c @@ -225,10 +225,15 @@ static void vdpasim_net_work(struct vdpasim *vdpasim) break; } - ++tx_pkts; read = vringh_iov_pull_iotlb(&txq->vring, &txq->out_iov, net->buffer, PAGE_SIZE); + if (read <= 0) { + ++tx_errors; + vdpasim_net_complete(txq, 0); + continue; + } + ++tx_pkts; tx_bytes += read; if (!receive_filter(vdpasim, read)) { |