|
 |
7711c0 |
From 3abb574bc7328eab1f67a1e470ea44c595b0c0b5 Mon Sep 17 00:00:00 2001
|
|
|
7711c0 |
From: Xiao Wang <jasowang@redhat.com>
|
|
|
7711c0 |
Date: Fri, 17 May 2019 07:29:36 +0200
|
|
|
7711c0 |
Subject: [PATCH 2/9] net: ignore packet size greater than INT_MAX
|
|
|
7711c0 |
|
|
|
7711c0 |
RH-Author: Xiao Wang <jasowang@redhat.com>
|
|
|
7711c0 |
Message-id: <1558078177-372-3-git-send-email-jasowang@redhat.com>
|
|
|
7711c0 |
Patchwork-id: 88014
|
|
|
7711c0 |
O-Subject: [RHEL7.7 qemu-kvm-rhev PATCH 2/3] net: ignore packet size greater than INT_MAX
|
|
|
7711c0 |
Bugzilla: 1636780
|
|
|
7711c0 |
RH-Acked-by: Thomas Huth <thuth@redhat.com>
|
|
|
7711c0 |
RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
|
|
|
7711c0 |
RH-Acked-by: Maxime Coquelin <maxime.coquelin@redhat.com>
|
|
|
7711c0 |
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
7711c0 |
|
|
|
7711c0 |
Bugzilla: 1636779
|
|
|
7711c0 |
|
|
|
7711c0 |
There should not be a reason for passing a packet size greater than
|
|
|
7711c0 |
INT_MAX. It's usually a hint of bug somewhere, so ignore packet size
|
|
|
7711c0 |
greater than INT_MAX in qemu_deliver_packet_iov()
|
|
|
7711c0 |
|
|
|
7711c0 |
CC: qemu-stable@nongnu.org
|
|
|
7711c0 |
Reported-by: Daniel Shapira <daniel@twistlock.com>
|
|
|
7711c0 |
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
7711c0 |
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
|
|
7711c0 |
(cherry picked from commit 1592a9947036d60dde5404204a5d45975133caf5)
|
|
|
7711c0 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
7711c0 |
---
|
|
|
7711c0 |
net/net.c | 7 ++++++-
|
|
|
7711c0 |
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
7711c0 |
|
|
|
7711c0 |
diff --git a/net/net.c b/net/net.c
|
|
|
7711c0 |
index 29f8398..c991243 100644
|
|
|
7711c0 |
--- a/net/net.c
|
|
|
7711c0 |
+++ b/net/net.c
|
|
|
7711c0 |
@@ -712,10 +712,15 @@ ssize_t qemu_deliver_packet_iov(NetClientState *sender,
|
|
|
7711c0 |
void *opaque)
|
|
|
7711c0 |
{
|
|
|
7711c0 |
NetClientState *nc = opaque;
|
|
|
7711c0 |
+ size_t size = iov_size(iov, iovcnt);
|
|
|
7711c0 |
int ret;
|
|
|
7711c0 |
|
|
|
7711c0 |
+ if (size > INT_MAX) {
|
|
|
7711c0 |
+ return size;
|
|
|
7711c0 |
+ }
|
|
|
7711c0 |
+
|
|
|
7711c0 |
if (nc->link_down) {
|
|
|
7711c0 |
- return iov_size(iov, iovcnt);
|
|
|
7711c0 |
+ return size;
|
|
|
7711c0 |
}
|
|
|
7711c0 |
|
|
|
7711c0 |
if (nc->receive_disabled) {
|
|
|
7711c0 |
--
|
|
|
7711c0 |
1.8.3.1
|
|
|
7711c0 |
|