On Thu, Jul 09, 2026 at 05:56:52PM -0400, Jon Maloy wrote:
> iov_tail_clone() returns ssize_t and can return -1 if the destination
> iov array is too small. Its return value was assigned directly to
> msg.msg_iovlen which is size_t, wrapping a negative value to a large
> unsigned number passed to recvmsg().
> 
> Check for failure and return early, letting the caller rewind the
> virtqueue.
> 
> Signed-off-by: Jon Maloy <jmaloy@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

> 
> ---
> v2: Use if-guard instead of assert(), since the error path is
>     a legitimate (if unlikely) condition handled by the caller.
> ---
>  udp_vu.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/udp_vu.c b/udp_vu.c
> index e4fb1057..edd9cae7 100644
> --- a/udp_vu.c
> +++ b/udp_vu.c
> @@ -67,11 +67,15 @@ static ssize_t udp_vu_sock_recv(struct iov_tail *payload, size_t *cnt, int s)
>  	struct iovec msg_iov[VIRTQUEUE_MAX_SIZE];
>  	struct msghdr msg  = { 0 };
>  	size_t iov_used;
> +	ssize_t iovlen;
>  	ssize_t dlen;
>  
> +	iovlen = iov_tail_clone(msg_iov, ARRAY_SIZE(msg_iov), payload);
> +	if (iovlen < 0)
> +		return -1;
> +
>  	msg.msg_iov = msg_iov;
> -	msg.msg_iovlen = iov_tail_clone(msg.msg_iov, ARRAY_SIZE(msg_iov),
> -					payload);
> +	msg.msg_iovlen = iovlen;
>  
>  	/* read data from the socket */
>  	dlen = recvmsg(s, &msg, 0);
> -- 
> 2.52.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson