On Fri, Jun 21, 2024 at 05:53:22PM +0200, Stefano Brivio wrote:
> This reverts commit c80fa6a6bb4415ad48f9e11424310875d0d99bc7, as it
> reintroduces the issue fixed by commit 1e6f92b995a9 ("udp: Fix 16-bit
> overflow in udp_invert_portmap()").
> 
> Reported-by: Laurent Jacquot <jk@lutty.net>
> Link: https://bugs.passt.top/show_bug.cgi?id=80
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Argh, dammit.  So,

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

.. but I think we really need to put a comment on this, otherwise one
of us is likely to make the same mistake again, because that
particular promotion rule is truly arcane.

> ---
>  udp.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/udp.c b/udp.c
> index e79ca93..8181900 100644
> --- a/udp.c
> +++ b/udp.c
> @@ -279,9 +279,10 @@ static void udp_invert_portmap(struct udp_fwd_ports *fwd)
>  		      "Forward and reverse delta arrays must have same size");
>  	for (i = 0; i < ARRAY_SIZE(fwd->f.delta); i++) {
>  		in_port_t delta = fwd->f.delta[i];
> +		in_port_t rport = i + delta;
>  
>  		if (delta)
> -			fwd->rdelta[i + delta] = NUM_PORTS - delta;
> +			fwd->rdelta[rport] = NUM_PORTS - delta;
>  	}
>  }
>  

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson