From a3b9f86f39a7effc2d74833055c23bee54887894 Mon Sep 17 00:00:00 2001 From: Jon Maloy Date: Thu, 9 Jul 2026 17:56:52 -0400 Subject: udp_vu: Check iov_tail_clone() return before assigning to msg_iovlen iov_tail_clone() returns ssize_t and can return -1 if the destination iov array is too small. Its return value was assigned directly to msg.msg_iovlen which is size_t, wrapping a negative value to a large unsigned number passed to recvmsg(). Check for failure and return early, letting the caller rewind the virtqueue. Signed-off-by: Jon Maloy Reviewed-by: David Gibson Signed-off-by: Stefano Brivio --- udp_vu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/udp_vu.c b/udp_vu.c index e4fb105..edd9cae 100644 --- a/udp_vu.c +++ b/udp_vu.c @@ -67,11 +67,15 @@ static ssize_t udp_vu_sock_recv(struct iov_tail *payload, size_t *cnt, int s) struct iovec msg_iov[VIRTQUEUE_MAX_SIZE]; struct msghdr msg = { 0 }; size_t iov_used; + ssize_t iovlen; ssize_t dlen; + iovlen = iov_tail_clone(msg_iov, ARRAY_SIZE(msg_iov), payload); + if (iovlen < 0) + return -1; + msg.msg_iov = msg_iov; - msg.msg_iovlen = iov_tail_clone(msg.msg_iov, ARRAY_SIZE(msg_iov), - payload); + msg.msg_iovlen = iovlen; /* read data from the socket */ dlen = recvmsg(s, &msg, 0); -- cgit v1.2.3