Linfeng Sun 0d195797a8 vdpa_sim_net: check TX pull result before RX copy ... vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a size_t length to receive_filter() and vringh_iov_push_iotlb(). A negative error can therefore become a large length in the RX path. Handle non-positive pull results before every length use. Count the TX error and complete the consumed TX descriptor with zero bytes. I found this bug myself, though the patch was written with AI assistance. Fixes: cfe2268929 ("vdpa_sim: filter destination mac address") Assisted-by: OpenAI-Codex:GPT-5 Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260901094842.25875-1-linfeng.sun.dev@gmail.com>		2026-09-07 18:54:03 -04:00
..
Makefile	vdpa: add vdpa simulator for block device	2021-05-03 04:55:53 -04:00
vdpa_sim_blk.c	vdpa_sim_blk: reject out-of-range sector starts	2026-09-07 18:54:03 -04:00
vdpa_sim_net.c	vdpa_sim_net: check TX pull result before RX copy	2026-09-07 18:54:03 -04:00
vdpa_sim.c	vdpa_sim: hold iommu_lock across dma_unmap passthrough transition	2026-08-19 06:38:45 -04:00
vdpa_sim.h	vdpa_sim: move buffer allocation in the devices	2023-04-21 03:02:35 -04:00