iov_tail_clone() returns ssize_t and can return -1 if the destination
iov array is too small. Its return value was assigned directly to
msg.msg_iovlen which is size_t, wrapping a negative value to a large
unsigned number passed to recvmsg().
Check for failure and return early, letting the caller rewind the
virtqueue.
Signed-off-by: Jon Maloy
---
v2: Use if-guard instead of assert(), since the error path is
a legitimate (if unlikely) condition handled by the caller.
---
udp_vu.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/udp_vu.c b/udp_vu.c
index e4fb1057..edd9cae7 100644
--- a/udp_vu.c
+++ b/udp_vu.c
@@ -67,11 +67,15 @@ static ssize_t udp_vu_sock_recv(struct iov_tail *payload, size_t *cnt, int s)
struct iovec msg_iov[VIRTQUEUE_MAX_SIZE];
struct msghdr msg = { 0 };
size_t iov_used;
+ ssize_t iovlen;
ssize_t dlen;
+ iovlen = iov_tail_clone(msg_iov, ARRAY_SIZE(msg_iov), payload);
+ if (iovlen < 0)
+ return -1;
+
msg.msg_iov = msg_iov;
- msg.msg_iovlen = iov_tail_clone(msg.msg_iov, ARRAY_SIZE(msg_iov),
- payload);
+ msg.msg_iovlen = iovlen;
/* read data from the socket */
dlen = recvmsg(s, &msg, 0);
--
2.52.0