From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=NhBD6syh; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 48DE35A0265 for ; Mon, 13 Jul 2026 07:39:03 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1783921140; bh=1wYvGZg8WbIj75NwFZPSoRLxRLqwA9chOhlHIFpmcf0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=NhBD6syhVvXKhjV0MIeVsdDGoBdGx1A/1818/1RZ/cdCSWcSCji7IHRfztAoCbrIS pQwh0DjLu6XYEe7jYnk6uBbtt11gPD2NzX2yi+F4IiDhk2QJ6UqZIqxdxhHgKMj2Ak TFBsh1m6DHk5cOUSdbwjy2hqvyVPhpg2H29h9FTtQAA6a0C5c/N96YDwl7s5k5KFJs on2SWFxwj7bt9gt7U48tmLZmNcVtbdtJ4X4lx6A/r8SgNuY6rNLakQJxsZGFnsITYE Rd1zKp2UDFigp9U2uTe6s4bC5eCz8hjswp/+mCxtvKT6cvRJjaNrnJdm/8z6IeHF+v Hv4LzDDfVFc0w== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gzB7m1h0nz4wHs; Mon, 13 Jul 2026 15:39:00 +1000 (AEST) Date: Mon, 13 Jul 2026 14:09:19 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v2 3/6] tap: Guard IPv6 tail size subtraction against underflow Message-ID: References: <20260709215656.1351549-1-jmaloy@redhat.com> <20260709215656.1351549-4-jmaloy@redhat.com> <88c01537-385f-40ed-821c-ef02f4c742b8@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hknXvEUInr3cLlMe" Content-Disposition: inline In-Reply-To: <88c01537-385f-40ed-821c-ef02f4c742b8@redhat.com> Message-ID-Hash: MU6HPBA6MBMXWRUHC7YJSARCPM3NWEX4 X-Message-ID-Hash: MU6HPBA6MBMXWRUHC7YJSARCPM3NWEX4 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --hknXvEUInr3cLlMe Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jul 10, 2026 at 09:40:03AM -0400, Jon Maloy wrote: >=20 >=20 > On 2026-07-09 21:36, David Gibson wrote: > > On Thu, Jul 09, 2026 at 05:56:53PM -0400, Jon Maloy wrote: > > > In tap6_handler(), iov_tail_size(&data) - sizeof(*ip6h) computes > > > the expected payload length. IOV_PEEK_HEADER() guarantees at least > > > sizeof(*ip6h) bytes, but add an explicit check to guard the unsigned > > > subtraction. A too-small tail would indicate a malformed packet, so > > > skip it. > > >=20 > > > Signed-off-by: Jon Maloy > > >=20 > > > --- > > > v2: Use if-guard instead of assert(), to avoid runtime cost in > > > per-packet path and to let the static checker follow the logic. >=20 > I had the idea that the compiler may be smart enough to optimize it out, > since it is logically redundant, as you note. I mean, maybe, although I think that's moderately unlikely. But assert() is nothing but a macro that says essentially if (!condition) abort(); So if the compiler can optimise away the if, it can optimise away the assert() as well. >=20 > /jon >=20 > >=20 > > Why would the if be cheaper than an assert()? The IOV_PEEK_HEADER() > > already checks the length, so this check is definitely redundant - it > > exists only for the benefit of static checkers. > >=20 > > > --- > > > tap.c | 5 ++++- > > > 1 file changed, 4 insertions(+), 1 deletion(-) > > >=20 > > > diff --git a/tap.c b/tap.c > > > index 6d93c7ce..6fd5f595 100644 > > > --- a/tap.c > > > +++ b/tap.c > > > @@ -986,7 +986,10 @@ resume: > > > if (!ip6h) > > > continue; > > > - check =3D iov_tail_size(&data) - sizeof(*ip6h); > > > + check =3D iov_tail_size(&data); > > > + if (check < sizeof(*ip6h)) > > > + continue; > > > + check -=3D sizeof(*ip6h); > > > saddr =3D &ip6h->saddr; > > > daddr =3D &ip6h->daddr; > > > --=20 > > > 2.52.0 > > >=20 > >=20 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --hknXvEUInr3cLlMe Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmpUZOQACgkQzQJF27ox 2Ge/yw/9GTwsELrygV3rmwP3gWzr/+vRxNJEmgBja018VwXW/uWiXmtiAyf9j4wP aTR+bAS3VV4kwXCsd0NRz6VEPz1M66VHNeSMSbVsAsaFigqt0uv8mqIUyvRR1t01 daiep/Yi02y566s3BkSHFmFGA7Ab1etRUDUWjHdTWgzfh78+7e7Sh7PoheYMhZcj WsgCMwxMQp+arHR3PLjXxlAG6F565S+Cj9S8T2lDnIVjOUige4g1Mp0K7xkhv586 bCKjkLw9olDpCBMnzdBUSLA4LhZGDCOJ3cFqGSg7hx/5Kli8WG3lfwicwRfhaotP U05uuhhN8j8KOMGL5jf5TwSnNzA8xomsWlL8tb8g895UY4Y3KCub3U08m0mpI1KD Tc8ZvNsnDDQkd14IyU5++Yhb+j6NiuFFumyQ+91iKKola0I07oElEo0y4XFaHN2s yhJhjJ7Ow0Ih3Uw8WWuE/UGNtdc3uVXaaKn71AbLs7dIxBlnLuLc5zoQvGLYW6R8 M87Py17ZygLM1avcK6U3RcJbxFRteC3svGtgbsyMAV6XTkwGdnfkV0+/qCh/cv17 yer2/w2xxg4eVXGwx8hLKbaV6AVl9WyLoZJxMy4DCSC/yFfoXo1I0DI4qfcoIXG0 cMYjXUYvifr+s4pAtUHW8sxlM5j/7t3Vde8D4uqE29HbrFlVWj0= =Xu9V -----END PGP SIGNATURE----- --hknXvEUInr3cLlMe--