Linfeng Sun 0d195797a8 vdpa_sim_net: check TX pull result before RX copy ...

vringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is
currently added to the unsigned byte counter and then passed as a size_t
length to receive_filter() and vringh_iov_push_iotlb().  A negative error
can therefore become a large length in the RX path.

Handle non-positive pull results before every length use.  Count the TX
error and complete the consumed TX descriptor with zero bytes.

I found this bug myself, though the patch was written with AI assistance.

Fixes: cfe2268929 ("vdpa_sim: filter destination mac address")
Assisted-by: OpenAI-Codex:GPT-5
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260901094842.25875-1-linfeng.sun.dev@gmail.com>

2026-09-07 18:54:03 -04:00

..

Makefile

vdpa: add vdpa simulator for block device

2021-05-03 04:55:53 -04:00

vdpa_sim_blk.c

vdpa_sim_blk: reject out-of-range sector starts

2026-09-07 18:54:03 -04:00

vdpa_sim_net.c

vdpa_sim_net: check TX pull result before RX copy

2026-09-07 18:54:03 -04:00

vdpa_sim.c

vdpa_sim: hold iommu_lock across dma_unmap passthrough transition

2026-08-19 06:38:45 -04:00

vdpa_sim.h

vdpa_sim: move buffer allocation in the devices

2023-04-21 03:02:35 -04:00