[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] Re: [PATCH] virtio-net: correct header length math
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] Re: [PATCH] virtio-net: correct header length math |
Date: |
Wed, 23 Jun 2010 18:55:27 +0300 |
User-agent: |
Mutt/1.5.19 (2009-01-05) |
On Wed, Jun 23, 2010 at 05:57:13PM +0200, Juan Quintela wrote:
> "Michael S. Tsirkin" <address@hidden> wrote:
> > We were requesting too much when checking buffer
> > length: size already includes host header length.
> >
> > Signed-off-by: Michael S. Tsirkin <address@hidden>
>
> All changes here are ok, but we are still missing more checks.
>
> > ---
> > hw/virtio-net.c | 20 +++++++++++---------
> > 1 files changed, 11 insertions(+), 9 deletions(-)
> >
> > diff --git a/hw/virtio-net.c b/hw/virtio-net.c
> > index 06ba481..2646c87 100644
> > --- a/hw/virtio-net.c
> > +++ b/hw/virtio-net.c
> > @@ -527,17 +527,18 @@ static ssize_t virtio_net_receive(VLANClientState
> > *nc, const uint8_t *buf, size_
> > {
> > VirtIONet *n = DO_UPCAST(NICState, nc, nc)->opaque;
> > struct virtio_net_hdr_mrg_rxbuf *mhdr = NULL;
> > - size_t hdr_len, offset, i;
> > + size_t guest_hdr_len, offset, i, host_hdr_len;
> >
> > if (!virtio_net_can_receive(&n->nic->nc))
> > return -1;
> >
> > /* hdr_len refers to the header we supply to the guest */
> > - hdr_len = n->mergeable_rx_bufs ?
> > + guest_hdr_len = n->mergeable_rx_bufs ?
> > sizeof(struct virtio_net_hdr_mrg_rxbuf) : sizeof(struct
> > virtio_net_hdr);
> >
> >
>
> nitpit: empty extra line
>
> > - if (!virtio_net_has_buffers(n, size + hdr_len))
> > + host_hdr_len = n->has_vnet_hdr ? sizeof(struct virtio_net_hdr) : 0;
> > + if (!virtio_net_has_buffers(n, size + guest_hdr_len - host_hdr_len))
> > return 0;
> >
> > if (!receive_filter(n, buf, size))
>
> size is not used by receive_filter. We are assuming that size is at
> least 16 + sizeof(struct virtio_net_hdr).
True, I guess receive_filter should be fixed.
>
> while (offset < size) {
>
> we are still testing offset with size, but we read headers from there
> also :(
>From where? As far as I can tell we always read size bytes from buf. No?
> Later, Juan.