[PATCH] hw/net/virtio-net: Remove dangerous cast in receive_header

[PATCH] hw/net/virtio-net: Remove dangerous cast in receive_header

[Weimin Xiong]

From: Xiong Weimin <xiongweimin@kylinos.cn>

The receive_header() function contains a "FIXME this cast is evil"
comment. The code does:
    void *wbuf = (void *)buf;

This cast from 'const void *' to 'void *' removes const qualifier which
could lead to unintended modifications. Instead, use a properly typed
pointer and pass it correctly to work_around_broken_dhclient().

Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
---
 hw/net/virtio-net.c | 12 +++++++----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 1234567890ab..fedcba098765 4321006
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1716,12 +1716,14 @@ static void receive_header(VirtIONet *n, const struct iovec *iov, int iov_cnt,
                            const void *buf, size_t size)
 {
     if (n->has_vnet_hdr) {
-        /* FIXME this cast is evil */
-        void *wbuf = (void *)buf;
-        work_around_broken_dhclient(wbuf, wbuf + n->host_hdr_len,
-                                    size - n->host_hdr_len);
+        const uint8_t *wbuf = buf;
+        uint8_t *payload = (uint8_t *)(wbuf + n->host_hdr_len);
+
+        work_around_broken_dhclient(wbuf, payload,
+                                    size - n->host_hdr_len);
 
         if (n->needs_vnet_hdr_swap) {
-            virtio_net_hdr_swap(VIRTIO_DEVICE(n), wbuf);
+            virtio_net_hdr_swap(VIRTIO_DEVICE(n), (void *)wbuf);
         }
         iov_from_buf(iov, iov_cnt, 0, buf, sizeof(struct virtio_net_hdr));
     } else {

Re: [PATCH] hw/net/virtio-net: Remove dangerous cast in receive_header

[Michael S. Tsirkin]

On Fri, Jul 24, 2026 at 05:38:09PM +0800, Weimin Xiong wrote:
> From: Xiong Weimin <xiongweimin@kylinos.cn>
> 
> The receive_header() function contains a "FIXME this cast is evil"
> comment. The code does:
>     void *wbuf = (void *)buf;
> 
> This cast from 'const void *' to 'void *' removes const qualifier which
> could lead to unintended modifications.

... and so you cast to uint8_t * instead, removing const qualifier.

> Instead, use a properly typed
> pointer and pass it correctly to work_around_broken_dhclient().
> 
> Signed-off-by: Xiong Weimin <xiongweimin@kylinos.cn>
> ---
>  hw/net/virtio-net.c | 12 +++++++----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> index 1234567890ab..fedcba098765 4321006
> --- a/hw/net/virtio-net.c
> +++ b/hw/net/virtio-net.c
> @@ -1716,12 +1716,14 @@ static void receive_header(VirtIONet *n, const struct iovec *iov, int iov_cnt,
>                             const void *buf, size_t size)
>  {
>      if (n->has_vnet_hdr) {
> -        /* FIXME this cast is evil */
> -        void *wbuf = (void *)buf;
> -        work_around_broken_dhclient(wbuf, wbuf + n->host_hdr_len,
> -                                    size - n->host_hdr_len);
> +        const uint8_t *wbuf = buf;
> +        uint8_t *payload = (uint8_t *)(wbuf + n->host_hdr_len);
> +

Forgive me how is this better?
what is properly typed and correctly about casting to uint8_t *?
As far as I can see all you did is remove a comment.

> +        work_around_broken_dhclient(wbuf, payload,
> +                                    size - n->host_hdr_len);
>  
>          if (n->needs_vnet_hdr_swap) {
> -            virtio_net_hdr_swap(VIRTIO_DEVICE(n), wbuf);
> +            virtio_net_hdr_swap(VIRTIO_DEVICE(n), (void *)wbuf);
>          }
>          iov_from_buf(iov, iov_cnt, 0, buf, sizeof(struct virtio_net_hdr));
>      } else {