diff options
| author | Linfeng Sun <linfeng.sun.dev@gmail.com> | 2026-09-01 17:48:42 +0800 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2026-09-07 18:54:03 -0400 |
| commit | 0d195797a80b77f2ec56718cd26d3ee65d0093e8 (patch) | |
| tree | d013b497e4ca1fd6b6fd22ecd9882dc7eddace33 /tools/perf/scripts/python/stackcollapse.py | |
| parent | 0a8693f00c408d85f086ad85d29e7030bf1e2055 (diff) | |
vdpa_sim_net: check TX pull result before RX copy
vringh_iov_pull_iotlb() returns a signed byte count. A failed TX pull is
currently added to the unsigned byte counter and then passed as a size_t
length to receive_filter() and vringh_iov_push_iotlb(). A negative error
can therefore become a large length in the RX path.
Handle non-positive pull results before every length use. Count the TX
error and complete the consumed TX descriptor with zero bytes.
I found this bug myself, though the patch was written with AI assistance.
Fixes: cfe226892913 ("vdpa_sim: filter destination mac address")
Assisted-by: OpenAI-Codex:GPT-5
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260901094842.25875-1-linfeng.sun.dev@gmail.com>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions