Linfeng Sun 0d195797a8 vdpa_sim_net: check TX pull result before RX copy ...

vringh_iov_pull_iotlb() returns a signed byte count.  A failed TX pull is
currently added to the unsigned byte counter and then passed as a size_t
length to receive_filter() and vringh_iov_push_iotlb().  A negative error
can therefore become a large length in the RX path.

Handle non-positive pull results before every length use.  Count the TX
error and complete the consumed TX descriptor with zero bytes.

I found this bug myself, though the patch was written with AI assistance.

Fixes: cfe2268929 ("vdpa_sim: filter destination mac address")
Assisted-by: OpenAI-Codex:GPT-5
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260901094842.25875-1-linfeng.sun.dev@gmail.com>

2026-09-07 18:54:03 -04:00

..

accel

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-09-05 20:45:18 -07:00

accessibility

…

acpi

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

amba

…

android

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25 09:38:50 -07:00

ata

ata: libata-scsi: do not raise UA for storage element depopulation and restoration

2026-09-03 16:10:44 +02:00

atm

…

auxdisplay

Merge tag 'auxdisplay-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-auxdisplay

2026-08-24 08:15:59 -07:00

base

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-09-05 20:45:18 -07:00

bcma

…

block

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-09-05 20:45:18 -07:00

bluetooth

Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()

2026-08-31 14:05:27 -04:00

bus

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25 09:38:50 -07:00

cache

…

cdrom

…

cdx

…

char

virtio_console: do not free control-out buffers on remove

2026-09-07 18:54:02 -04:00

clk

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

clocksource

Merge tag 'hyperv-next-signed-20260826' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

2026-08-26 16:47:40 -07:00

comedi

…

connector

…

counter

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25 09:38:50 -07:00

cpufreq

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

cpuidle

cpuidle: dt_idle_genpd: kfree() the original name allocation

2026-09-01 17:28:56 +02:00

crypto

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

cxl

…

dax

Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-08-20 18:17:08 -07:00

dca

…

devfreq

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

dibs

net/dibs: Correct freeing of dmb_clientid_arr

2026-08-12 17:08:05 -07:00

dio

…

dma

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

dma-buf

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-09-05 20:45:18 -07:00

dpll

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-08-18 10:42:41 -07:00

edac

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

eisa

…

extcon

…

firewire

Merge tag 'firewire-updates-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

2026-08-22 08:41:28 -07:00

firmware

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

fpga

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

fsi

…

fwctl

rust: introduce abstractions for fwctl

2026-08-14 19:21:17 -03:00

gnss

…

gpib

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25 09:38:50 -07:00

gpio

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

gpu

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-09-05 20:45:18 -07:00

greybus

…

hid

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

hsi

Merge tag 'hsi-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi

2026-08-21 12:01:23 -07:00

hte

…

hv

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

hwmon

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

hwspinlock

…

hwtracing

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

i2c

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

i3c

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

idle

Merge branch 'intel-idle-lpi'

2026-08-07 21:22:50 +02:00

iio

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

infiniband

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

input

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

interconnect

Merge tag 'icc-7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next

2026-08-19 09:55:37 +02:00

iommu

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

ipack

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25 09:38:50 -07:00

irqchip

Merge tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-09-06 10:35:24 -07:00

leds

Merge tag 'leds-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds

2026-08-27 11:05:51 -07:00

macintosh

…

mailbox

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

mcb

…

md

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

media

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

memory

Merge tag 'mtd/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2026-08-23 09:11:21 -07:00

memstick

…

message

…

mfd

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

misc

Merge drm/drm-fixes into drm-misc-fixes

2026-09-01 09:38:51 +02:00

mmc

Merge tag 'mmc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

2026-08-21 11:58:08 -07:00

most

…

mtd

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

mux

…

net

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

nfc

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-08-18 10:42:41 -07:00

ntb

NTB: ntb_transport: Reject oversized TX buffers

2026-08-20 13:43:24 -07:00

nubus

…

nvdimm

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

nvme

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-09-05 20:45:18 -07:00

nvmem

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25 09:38:50 -07:00

of

Merge tag 'devicetree-fixes-for-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2026-08-27 12:53:43 -07:00

opp

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

parisc

parisc: eisa: Fix infinite loop when parsing invalid IRQ value

2026-08-18 11:43:05 +02:00

parport

…

pci

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

pcmcia

…

peci

…

perf

Merge tag 'riscv-for-linus-7.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux

2026-08-20 14:53:54 -07:00

phy

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

2026-08-26 11:14:30 -07:00

pinctrl

Merge tag 'pinctrl-v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

2026-08-24 08:46:03 -07:00

platform

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

pmdomain

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

pnp

Merge branches 'acpi-numa', 'acpi-misc' and 'pnp'

2026-08-07 20:01:31 +02:00

power

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

powercap

Merge tag 'pm-7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2026-08-26 14:13:26 -07:00

pps

…

ps3

…

ptp

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

pwm

Merge tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

2026-08-19 10:42:18 -07:00

rapidio

…

ras

Merge tag 'edac_updates_for_v7.3_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras

2026-08-31 20:10:39 -07:00

regulator

Merge tag 'regulator-fix-v7.3-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

2026-08-27 12:21:56 -07:00

remoteproc

…

resctrl

Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

2026-08-18 11:57:17 -07:00

reset

Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

2026-08-26 11:14:30 -07:00

rpmsg

…

rtc

Merge tag 'rtc-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux

2026-08-28 09:53:43 -07:00

s390

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

sbus

…

scsi

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-09-05 20:45:18 -07:00

sh

…

siox

…

slimbus

…

soc

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

soundwire

Merge tag 'soundwire-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire

2026-08-24 12:16:16 -07:00

spi

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

spmi

…

ssb

…

staging

Merge tag 'staging-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2026-09-06 09:49:06 -07:00

target

scsi: target: iscsi: Reserve a terminator byte for the login payload

2026-09-01 22:08:31 -04:00

tc

…

tee

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

thermal

Merge tag 'mfd-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd

2026-08-27 10:45:08 -07:00

thunderbolt

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

tty

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

ufs

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-09-05 20:45:18 -07:00

uio

…

usb

Merge tag 'usb-7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

2026-09-06 08:50:20 -07:00

vdpa

vdpa_sim_net: check TX pull result before RX copy

2026-09-07 18:54:03 -04:00

vfio

Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-08-20 18:17:08 -07:00

vhost

vhost-vdpa: protect config_ctx from being freed under the config callback

2026-09-07 18:54:02 -04:00

video

Merge tag 'backlight-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight

2026-08-27 11:16:39 -07:00

virt

Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

2026-08-18 11:57:17 -07:00

virtio

virtio-vdpa: Use queue id when setting vq affinity

2026-09-07 18:54:03 -04:00

w1

…

watchdog

Merge tag 'mfd-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd

2026-08-27 10:45:08 -07:00

xen

treewide: refresh kmalloc_obj() conversions

2026-09-04 21:37:00 -07:00

zorro

…

Kconfig

…

Makefile

…