On Thu, Jul 09, 2026 at 05:56:52PM -0400, Jon Maloy wrote:
iov_tail_clone() returns ssize_t and can return -1 if the destination iov array is too small. Its return value was assigned directly to msg.msg_iovlen which is size_t, wrapping a negative value to a large unsigned number passed to recvmsg().
Check for failure and return early, letting the caller rewind the virtqueue.
Signed-off-by: Jon Maloy
Reviewed-by: David Gibson
--- v2: Use if-guard instead of assert(), since the error path is a legitimate (if unlikely) condition handled by the caller. --- udp_vu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/udp_vu.c b/udp_vu.c index e4fb1057..edd9cae7 100644 --- a/udp_vu.c +++ b/udp_vu.c @@ -67,11 +67,15 @@ static ssize_t udp_vu_sock_recv(struct iov_tail *payload, size_t *cnt, int s) struct iovec msg_iov[VIRTQUEUE_MAX_SIZE]; struct msghdr msg = { 0 }; size_t iov_used; + ssize_t iovlen; ssize_t dlen;
+ iovlen = iov_tail_clone(msg_iov, ARRAY_SIZE(msg_iov), payload); + if (iovlen < 0) + return -1; + msg.msg_iov = msg_iov; - msg.msg_iovlen = iov_tail_clone(msg.msg_iov, ARRAY_SIZE(msg_iov), - payload); + msg.msg_iovlen = iovlen;
/* read data from the socket */ dlen = recvmsg(s, &msg, 0); -- 2.52.0
-- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson