From 4f2c8e79130ef3d6132e34c49746e397745f9d73 Mon Sep 17 00:00:00 2001 From: Laurent Vivier Date: Tue, 21 Jan 2025 14:16:02 +0100 Subject: vhost_user: Drop packet with unsupported iovec array If the iovec array cannot be managed, drop it rather than passing the second entry to tap_add_packet(). Signed-off-by: Laurent Vivier Signed-off-by: Stefano Brivio --- vu_common.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/vu_common.c b/vu_common.c index aa5ca7b..f43d8ac 100644 --- a/vu_common.c +++ b/vu_common.c @@ -195,15 +195,17 @@ static void vu_handle_tx(struct vu_dev *vdev, int index, hdrlen); } else { /* vnet header can be in a separate iovec */ - if (elem[count].out_num != 2) + if (elem[count].out_num != 2) { debug("virtio-net transmit queue contains more than one buffer ([%d]: %u)", count, elem[count].out_num); - if (elem[count].out_sg[0].iov_len != (size_t)hdrlen) + } else if (elem[count].out_sg[0].iov_len != (size_t)hdrlen) { debug("virtio-net transmit queue entry not aligned on hdrlen ([%d]: %d != %zu)", - count, hdrlen, elem[count].out_sg[0].iov_len); - tap_add_packet(vdev->context, - elem[count].out_sg[1].iov_len, - (char *)elem[count].out_sg[1].iov_base); + count, hdrlen, elem[count].out_sg[0].iov_len); + } else { + tap_add_packet(vdev->context, + elem[count].out_sg[1].iov_len, + (char *)elem[count].out_sg[1].iov_base); + } } count++; -- cgit v1.2.3