On Wed, Jul 08, 2026 at 06:31:59PM -0400, Jon Maloy wrote:
> In tap6_handler(), iov_tail_size(&data) - sizeof(*ip6h) is used to
> compute the expected payload length. The subtraction is safe because
> IOV_PEEK_HEADER() already verified that the tail contains at least
> sizeof(*ip6h) bytes, but add an assert to make the invariant
> explicit.

Again, I think "assumption" would be clearer.  I think of "invariant"
as something that applies at every iteration of a loop, or to a data
structure at all times, rather than just to a particular variable at a
particular point

> 
> Signed-off-by: Jon Maloy <jmaloy@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

> ---
>  tap.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/tap.c b/tap.c
> index 6d93c7ce..d0d5148e 100644
> --- a/tap.c
> +++ b/tap.c
> @@ -986,7 +986,9 @@ resume:
>  		if (!ip6h)
>  			continue;
>  
> -		check = iov_tail_size(&data) - sizeof(*ip6h);
> +		check = iov_tail_size(&data);
> +		assert(check >= sizeof(*ip6h));
> +		check -= sizeof(*ip6h);
>  
>  		saddr = &ip6h->saddr;
>  		daddr = &ip6h->daddr;
> -- 
> 2.52.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson