From 3f9f6299a1bc46ff462142c7398a5953e3640cc2 Mon Sep 17 00:00:00 2001 From: Vladimir Sementsov-Ogievskiy Date: Wed, 16 Jul 2025 10:28:53 +0300 Subject: [PATCH] net/tap: drop too small packets Theoretically tap_read_packet() may return size less than s->host_vnet_hdr_len, and next, we'll work with negative size (in case of !s->using_vnet_hdr). Let's avoid it. Don't proceed with size == s->host_vnet_hdr_len as well in case of !s->using_vnet_hdr, it doesn't make sense. Tested-by: Lei Yang Signed-off-by: Vladimir Sementsov-Ogievskiy Signed-off-by: Jason Wang --- net/tap.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/tap.c b/net/tap.c index 23536c09b4..2a85936019 100644 --- a/net/tap.c +++ b/net/tap.c @@ -190,6 +190,11 @@ static void tap_send(void *opaque) break; } + if (s->host_vnet_hdr_len && size <= s->host_vnet_hdr_len) { + /* Invalid packet */ + break; + } + if (s->host_vnet_hdr_len && !s->using_vnet_hdr) { buf += s->host_vnet_hdr_len; size -= s->host_vnet_hdr_len; -- 2.47.2