yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-net-ignore-packet-size-greater-than-INT_MAX.patch

ae23c9
From 725b20685e3faf11198560a6d9035c394ef77594 Mon Sep 17 00:00:00 2001
ae23c9
From: Xiao Wang <jasowang@redhat.com>
ae23c9
Date: Fri, 11 Jan 2019 07:58:59 +0000
ae23c9
Subject: [PATCH 04/11] net: ignore packet size greater than INT_MAX
ae23c9
MIME-Version: 1.0
ae23c9
Content-Type: text/plain; charset=UTF-8
ae23c9
Content-Transfer-Encoding: 8bit
ae23c9
ae23c9
RH-Author: Xiao Wang <jasowang@redhat.com>
ae23c9
Message-id: <20190111075904.2030-5-jasowang@redhat.com>
ae23c9
Patchwork-id: 83978
ae23c9
O-Subject: [RHEL8 qemu-kvm PATCH 4/9] net: ignore packet size greater than INT_MAX
ae23c9
Bugzilla: 1636784
ae23c9
RH-Acked-by: Thomas Huth <thuth@redhat.com>
ae23c9
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
ae23c9
RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
ae23c9
RH-Acked-by: Maxime Coquelin <maxime.coquelin@redhat.com>
ae23c9
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
ae23c9
ae23c9
There should not be a reason for passing a packet size greater than
ae23c9
INT_MAX. It's usually a hint of bug somewhere, so ignore packet size
ae23c9
greater than INT_MAX in qemu_deliver_packet_iov()
ae23c9
ae23c9
CC: qemu-stable@nongnu.org
ae23c9
Reported-by: Daniel Shapira <daniel@twistlock.com>
ae23c9
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
ae23c9
Signed-off-by: Jason Wang <jasowang@redhat.com>
ae23c9
(cherry picked from commit 1592a9947036d60dde5404204a5d45975133caf5)
ae23c9
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
ae23c9
---
ae23c9
 net/net.c | 7 ++++++-
ae23c9
 1 file changed, 6 insertions(+), 1 deletion(-)
ae23c9
ae23c9
diff --git a/net/net.c b/net/net.c
ae23c9
index 29f8398..c991243 100644
ae23c9
--- a/net/net.c
ae23c9
+++ b/net/net.c
ae23c9
@@ -712,10 +712,15 @@ ssize_t qemu_deliver_packet_iov(NetClientState *sender,
ae23c9
                                 void *opaque)
ae23c9
 {
ae23c9
     NetClientState *nc = opaque;
ae23c9
+    size_t size = iov_size(iov, iovcnt);
ae23c9
     int ret;
ae23c9
 
ae23c9
+    if (size > INT_MAX) {
ae23c9
+        return size;
ae23c9
+    }
ae23c9
+
ae23c9
     if (nc->link_down) {
ae23c9
-        return iov_size(iov, iovcnt);
ae23c9
+        return size;
ae23c9
     }
ae23c9
 
ae23c9
     if (nc->receive_disabled) {
ae23c9
-- 
ae23c9
1.8.3.1
ae23c9