From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=I+N/VMRm; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id 541075A0265 for ; Mon, 13 Jul 2026 12:17:22 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783937841; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZsnnowgD3m8rqxtFLyuVVVp6eqhL4bGEQBi7D0JL8PY=; b=I+N/VMRmD6mnfVo6wFrnB4BgaE48hSzb3l9PQT1ssMymXURerPHAgcbFLYSacOqsOUgt5/ j+ZsiFpIgqGGZBcIc1FMAPxHUuvh3Hzyqxm4LJiN2ez2URRhkOL9rjtciJVf5zlwDO01kK vEY+OYumLg03maz6N+Ox+ZUUDHnyxVc= Received: from mail-qt1-f200.google.com (mail-qt1-f200.google.com [209.85.160.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-570-Vvp91U9BOIu_eXs9MrhYsQ-1; Mon, 13 Jul 2026 06:17:20 -0400 X-MC-Unique: Vvp91U9BOIu_eXs9MrhYsQ-1 X-Mimecast-MFC-AGG-ID: Vvp91U9BOIu_eXs9MrhYsQ_1783937839 Received: by mail-qt1-f200.google.com with SMTP id d75a77b69052e-51c21c01cf3so59496301cf.2 for ; Mon, 13 Jul 2026 03:17:20 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783937839; x=1784542639; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ZsnnowgD3m8rqxtFLyuVVVp6eqhL4bGEQBi7D0JL8PY=; b=pYGisIfFuD6JToxiQ8o3a5p9BSHbyDrYSUg1iRMhQzcDjFKDi0RKQERtaYeG1TKnEp NSVhI7d0Q4iOGpN27KmciITiQ9iaepq9RV2SOHg66Io6vBu+v/I3rSFLolDGdOgmUCJ2 8Kw0Z2b2NFAG1D1QPrb+2NvJN+SlKwkZwEfEN+yiZdnZ5IVU2VLU43ithj3xSOlgUQFf P+K908QbgyF6qR8P13TxBu+PzkG4w5atBlB3FmLw8cbcADAd2oprmxebEVREeEjuImdB 3IstB7o3yOqMriUg6rXZ0iq5/2DC3kyqXYYKJlg7xTMwab4teHljgyUtOIzXZ1Il4azy wOnw== X-Forwarded-Encrypted: i=1; AHgh+Rpk1NeKtJOehQXapFDiefpnSbDpDpN4q8fUUByTzR7oPGcJ0vuLwDuXLOqwOAiokCGzB5mEuSeiVLM=@passt.top X-Gm-Message-State: AOJu0YzsiU5DMPtgQV9USTWyULaeECAY41wGVXntgJacfNPpadjXVMEw BI0Zuxa4UsOKwT16ICZeKMt82mRYkI1pBUU1zY/BhjeaLU8f+xLI89Jz5td6zgAsWDPP5qfs/rh Jhkrf9DQwHBX9ixI+UEOTKTp9eXH6EadhbPLkmjwoFH7GIWK34y67Iw== X-Gm-Gg: AfdE7cnguE6rD8iMg5seISvLVenuaW9rLk0qpkF5Ta5ZSrMo+SgRuafGU/kJMWkPw5j r2fAgYRaQXYEEZJ3Jfb9kjCpTW6jUhuQlEhfv0kDaQcEDy8W79T90J3w94/uLTdTxE5T43KxVgB zpVLZvCxZcbwVc65ZLsXrogpAn2Sne3HujO+lsxu1ewUYhsOkprgAr3pK+gpranaPp1k+qEa2Sa V2VXpx30E9pQtm1K4FGlfM9y/VhuYqNXNj1JVt0V3c15H9FZjIPKY72eSc446FahPa2uglGPYSq yErHjKh4daK1LbS87mDlhonZjSu9Rhcarf3WGHIVINAYzpr+wKBrOktaM7nEjkfcHrMNeAzPEtH 0YYDf/JWv5QOYf/svybzEOR+saF1iPOLwK1E8CzhyCXYXVI7E3VTV4xMOscQHGOCr/3XhZHV+kV JSaS0= X-Received: by 2002:ac8:7d0e:0:b0:51c:7b12:120f with SMTP id d75a77b69052e-51cbf347db7mr81033741cf.77.1783937839475; Mon, 13 Jul 2026 03:17:19 -0700 (PDT) X-Received: by 2002:ac8:7d0e:0:b0:51c:7b12:120f with SMTP id d75a77b69052e-51cbf347db7mr81033591cf.77.1783937839021; Mon, 13 Jul 2026 03:17:19 -0700 (PDT) Received: from [192.168.2.15] (lnsm6-montreal02-142-122-43-198.internet.virginmobile.ca. [142.122.43.198]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8ffd81f4bbdsm122954296d6.36.2026.07.13.03.17.18 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 13 Jul 2026 03:17:18 -0700 (PDT) Message-ID: <85b1fb9a-bfee-4f4f-9fda-0beb26f490db@redhat.com> Date: Mon, 13 Jul 2026 06:17:17 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 3/6] tap: Guard IPv6 tail size subtraction against underflow To: David Gibson References: <20260709215656.1351549-1-jmaloy@redhat.com> <20260709215656.1351549-4-jmaloy@redhat.com> <88c01537-385f-40ed-821c-ef02f4c742b8@redhat.com> From: Jon Maloy In-Reply-To: X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: otd_ZO-pOsUvUi9mvH2LK7FfKtY2jKU5XXvr0IQucso_1783937839 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Message-ID-Hash: NTOS3L5Z5PSBGTIELSWIWKHTWVVLRKYF X-Message-ID-Hash: NTOS3L5Z5PSBGTIELSWIWKHTWVVLRKYF X-MailFrom: jmaloy@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 2026-07-13 00:09, David Gibson wrote: > On Fri, Jul 10, 2026 at 09:40:03AM -0400, Jon Maloy wrote: >> >> >> On 2026-07-09 21:36, David Gibson wrote: >>> On Thu, Jul 09, 2026 at 05:56:53PM -0400, Jon Maloy wrote: >>>> In tap6_handler(), iov_tail_size(&data) - sizeof(*ip6h) computes >>>> the expected payload length. IOV_PEEK_HEADER() guarantees at least >>>> sizeof(*ip6h) bytes, but add an explicit check to guard the unsigned >>>> subtraction. A too-small tail would indicate a malformed packet, so >>>> skip it. >>>> >>>> Signed-off-by: Jon Maloy >>>> >>>> --- >>>> v2: Use if-guard instead of assert(), to avoid runtime cost in >>>> per-packet path and to let the static checker follow the logic. >> >> I had the idea that the compiler may be smart enough to optimize it out, >> since it is logically redundant, as you note. > > I mean, maybe, although I think that's moderately unlikely. But > assert() is nothing but a macro that says essentially > if (!condition) abort(); > So if the compiler can optimise away the if, it can optimise away the > assert() as well. Yes. But the analyzer will still mark it as an issue, which it won't if there is an if-clause. /jon > >> >> /jon >> >>> >>> Why would the if be cheaper than an assert()? The IOV_PEEK_HEADER() >>> already checks the length, so this check is definitely redundant - it >>> exists only for the benefit of static checkers. >>> >>>> --- >>>> tap.c | 5 ++++- >>>> 1 file changed, 4 insertions(+), 1 deletion(-) >>>> >>>> diff --git a/tap.c b/tap.c >>>> index 6d93c7ce..6fd5f595 100644 >>>> --- a/tap.c >>>> +++ b/tap.c >>>> @@ -986,7 +986,10 @@ resume: >>>> if (!ip6h) >>>> continue; >>>> - check = iov_tail_size(&data) - sizeof(*ip6h); >>>> + check = iov_tail_size(&data); >>>> + if (check < sizeof(*ip6h)) >>>> + continue; >>>> + check -= sizeof(*ip6h); >>>> saddr = &ip6h->saddr; >>>> daddr = &ip6h->daddr; >>>> -- >>>> 2.52.0 >>>> >>> >> >