From: Juan Quintela <quintela@redhat.com>
In-Reply-To: <20100623095118.GA9796@redhat.com> (Michael S. Tsirkin's message
	of "Wed, 23 Jun 2010 12:51:18 +0300")
References: <20100623095118.GA9796@redhat.com>
Date: Wed, 23 Jun 2010 17:57:13 +0200
Message-ID: <m3eifxrbc6.fsf@trasno.mitica>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Subject: [Qemu-devel] Re: [PATCH] virtio-net: correct header length math
To: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Amit Shah <amit.shah@redhat.com>, alex.williamson@redhat.com, qemu-devel@nongnu.org

"Michael S. Tsirkin" <mst@redhat.com> wrote:
> We were requesting too much when checking buffer
> length: size already includes host header length.
>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

All changes here are  ok, but we are still missing more checks.

> ---
>  hw/virtio-net.c |   20 +++++++++++---------
>  1 files changed, 11 insertions(+), 9 deletions(-)
>
> diff --git a/hw/virtio-net.c b/hw/virtio-net.c
> index 06ba481..2646c87 100644
> --- a/hw/virtio-net.c
> +++ b/hw/virtio-net.c
> @@ -527,17 +527,18 @@ static ssize_t virtio_net_receive(VLANClientState *nc, const uint8_t *buf, size_
>  {
>      VirtIONet *n = DO_UPCAST(NICState, nc, nc)->opaque;
>      struct virtio_net_hdr_mrg_rxbuf *mhdr = NULL;
> -    size_t hdr_len, offset, i;
> +    size_t guest_hdr_len, offset, i, host_hdr_len;
>  
>      if (!virtio_net_can_receive(&n->nic->nc))
>          return -1;
>  
>      /* hdr_len refers to the header we supply to the guest */
> -    hdr_len = n->mergeable_rx_bufs ?
> +    guest_hdr_len = n->mergeable_rx_bufs ?
>          sizeof(struct virtio_net_hdr_mrg_rxbuf) : sizeof(struct virtio_net_hdr);
>  
>  

nitpit: empty extra line

> -    if (!virtio_net_has_buffers(n, size + hdr_len))
> +    host_hdr_len = n->has_vnet_hdr ? sizeof(struct virtio_net_hdr) : 0;
> +    if (!virtio_net_has_buffers(n, size + guest_hdr_len - host_hdr_len))
>          return 0;
>  
>      if (!receive_filter(n, buf, size))

size is not used by receive_filter.  We are assuming that size is at
least 16 + sizeof(struct virtio_net_hdr).

    while (offset < size) {

we are still testing offset with size, but we read headers from there
also :(

Later, Juan.