Linfeng Sun 0d195797a8 vdpa_sim_net: check TX pull result before RX copy ...

vringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is
currently added to the unsigned byte counter and then passed as a size_t
length to receive_filter() and vringh_iov_push_iotlb().  A negative error
can therefore become a large length in the RX path.

Handle non-positive pull results before every length use.  Count the TX
error and complete the consumed TX descriptor with zero bytes.

I found this bug myself, though the patch was written with AI assistance.

Fixes: cfe2268929 ("vdpa_sim: filter destination mac address")
Assisted-by: OpenAI-Codex:GPT-5
Signed-off-by: Linfeng Sun <[email protected]>
Signed-off-by: Michael S. Tsirkin <[email protected]>
Message-ID: <[email protected]>

2026-09-07 18:54:03 -04:00

..

Makefile

…

vdpa_sim_blk.c

vdpa_sim_blk: reject out-of-range sector starts

2026-09-07 18:54:03 -04:00

vdpa_sim_net.c

vdpa_sim_net: check TX pull result before RX copy

2026-09-07 18:54:03 -04:00

vdpa_sim.c

vdpa_sim: hold iommu_lock across dma_unmap passthrough transition

2026-08-19 06:38:45 -04:00

vdpa_sim.h

vdpa_sim: move buffer allocation in the devices

2023-04-21 03:02:35 -04:00