From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=54743 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1OSD7d-0004ra-6g
	for qemu-devel@nongnu.org; Fri, 25 Jun 2010 13:55:31 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.69)
	(envelope-from <amit.shah@redhat.com>) id 1OS38Q-0002Zk-8J
	for qemu-devel@nongnu.org; Fri, 25 Jun 2010 03:15:35 -0400
Received: from mx1.redhat.com ([209.132.183.28]:49788)
	by eggs.gnu.org with esmtp (Exim 4.69)
	(envelope-from <amit.shah@redhat.com>) id 1OS38Q-0002Zd-1V
	for qemu-devel@nongnu.org; Fri, 25 Jun 2010 03:15:34 -0400
Received: from int-mx03.intmail.prod.int.phx2.redhat.com
	(int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.16])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o5P7FVOd013135
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
	for <qemu-devel@nongnu.org>; Fri, 25 Jun 2010 03:15:31 -0400
Date: Fri, 25 Jun 2010 12:47:03 +0530
From: Amit Shah <amit.shah@redhat.com>
Message-ID: <20100625071703.GA1332@amit-laptop.redhat.com>
References: <20100624155407.GA11165@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20100624155407.GA11165@redhat.com>
Subject: [Qemu-devel] Re: [PATCHv3] virtio-net: correct packet length math
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "Michael S. Tsirkin" <mst@redhat.com>
Cc: alex.williamson@redhat.com, qemu-devel@nongnu.org, Juan Quintela <quintela@redhat.com>

On (Thu) Jun 24 2010 [18:54:07], Michael S. Tsirkin wrote:
> We were requesting too much when checking buffer
> length: size already includes host header length.
> 
> Further, we should not exit if we get a packet that
> is too long, since this might not be under control
> of the guest. Just drop the packet.

control of the host?

> @@ -579,19 +581,32 @@ static ssize_t virtio_net_receive(VLANClientState *nc, const uint8_t *buf, size_
>                  mhdr = (struct virtio_net_hdr_mrg_rxbuf *)sg[0].iov_base;
>  
>              offset += receive_header(n, sg, elem.in_num,
> -                                     buf + offset, size - offset, hdr_len);
> -            total += hdr_len;
> +                                     buf + offset, size - offset, guest_hdr_len);
> +            total += guest_hdr_len;
>          }
>  
>          /* copy in packet.  ugh */
>          len = iov_from_buf(sg, elem.in_num,
>                             buf + offset, size - offset);
>          total += len;
> +        offset += len;
> +        /* If buffers can't be merged, at this point we
> +         * must have consumed the complete packet.
> +         * Otherwise, drop it. */
> +        if (!n->mergeable_rx_bufs && offset < size) {
> +#if 0
> +            fprintf(stderr, "virtio-net truncated non-mergeable packet: "
> +
> +                    "i %zd mergeable %d offset %zd, size %zd, "
> +                    "guest hdr len %zd, host hdr len %zd\n",
> +                    i, n->mergeable_rx_bufs,
> +                    offset, size, guest_hdr_len, host_hdr_len);
> +#endif
> +            return size;
> +        }

Before returning, won't you have to finish off the virtqueue operations
-- fill, flush, kick, etc.?

		Amit