Re: [PATCH v2 3/6] tap: Guard IPv6 tail size subtraction against underflow

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 1443 bytes --]

On Thu, Jul 09, 2026 at 05:56:53PM -0400, Jon Maloy wrote:
> In tap6_handler(), iov_tail_size(&data) - sizeof(*ip6h) computes
> the expected payload length. IOV_PEEK_HEADER() guarantees at least
> sizeof(*ip6h) bytes, but add an explicit check to guard the unsigned
> subtraction. A too-small tail would indicate a malformed packet, so
> skip it.
> 
> Signed-off-by: Jon Maloy <jmaloy@redhat.com>
> 
> ---
> v2: Use if-guard instead of assert(), to avoid runtime cost in
>     per-packet path and to let the static checker follow the logic.

Why would the if be cheaper than an assert()?  The IOV_PEEK_HEADER()
already checks the length, so this check is definitely redundant - it
exists only for the benefit of static checkers.

> ---
>  tap.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/tap.c b/tap.c
> index 6d93c7ce..6fd5f595 100644
> --- a/tap.c
> +++ b/tap.c
> @@ -986,7 +986,10 @@ resume:
>  		if (!ip6h)
>  			continue;
>  
> -		check = iov_tail_size(&data) - sizeof(*ip6h);
> +		check = iov_tail_size(&data);
> +		if (check < sizeof(*ip6h))
> +			continue;
> +		check -= sizeof(*ip6h);
>  
>  		saddr = &ip6h->saddr;
>  		daddr = &ip6h->daddr;
> -- 
> 2.52.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]