On Thu, 2026-10-15 at 08:52 -0400, Michael S. Tsirkin wrote:
On Thu, Oct 15, 2026 at 02:47:01PM +0200, Johannes Berg wrote:
quoted
On Thu, 2026-10-15 at 08:41 -0400, Michael S. Tsirkin wrote:
quoted
virtio_net_hdr_to_skb() refuses packets whose checksum metadata
it cannot make sense of, but the vector raw transport ignored
its return value: rejected packets went on into the stack with
their metadata unvalidated.
Propagate the failure.
Assisted-by: LLM
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
arch/um/drivers/vector_transports.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/um/drivers/vector_transports.c b/arch/um/drivers/vector_transports.c
index e1fb2a76fdff..8b7548458663 100644
--- a/arch/um/drivers/vector_transports.c
+++ b/arch/um/drivers/vector_transports.c
@@ -210,7 +210,9 @@ static int raw_verify_header(
return 1;
skb_set_network_header(skb, ETH_HLEN);
- virtio_net_hdr_to_skb(skb, vheader, virtio_legacy_is_little_endian());
+ if (virtio_net_hdr_to_skb(skb, vheader,
+ virtio_legacy_is_little_endian()) < 0)
+ return -1;
return 0;
Seems it'd be simpler to just
return virtio_net_hdr_to_skb(...);
As far as I can tell, the function only returns -EINVAL or 0 (never a
positive value), and the caller only cares about negative (error) or
positive (no checksum needed), so that'd be equivalent?
johannes
if raw_verify_header can safely return any errno - i did not want to
audit it.
You already used an LLM and still didn't want to? ;-)
I checked briefly (by hand) and it seems fine, it's assigned to the
function pointer, which only has two callers on the _kern.c side.
johannes