[RFC,PATCH-for-5.2,2/2] net: Assert no packet bigger than NET_BUFSIZE is queued

Commit Message

Philippe Mathieu-Daudé Nov. 27, 2020, 3:45 p.m. UTC

Ensure no packet bigger then NET_BUFSIZE is queued via
qemu_net_queue_append*() by adding assertions.

Signed-off-by: Philippe Mathieu-Daudé <[e-mail]>
---
 net/queue.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Jason Wang Nov. 30, 2020, 2:50 a.m. UTC | #1

On 2020/11/27 下午11:45, Philippe Mathieu-Daudé wrote:
> Ensure no packet bigger then NET_BUFSIZE is queued via
> qemu_net_queue_append*() by adding assertions.
>
> Signed-off-by: Philippe Mathieu-Daudé <[e-mail]>
> ---
>   net/queue.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/net/queue.c b/net/queue.c
> index 221a1c87961..94b98b19ef9 100644
> --- a/net/queue.c
> +++ b/net/queue.c
> @@ -102,6 +102,8 @@ static void qemu_net_queue_append(NetQueue *queue,
>       if (queue->nq_count >= queue->nq_maxlen && !sent_cb) {
>           return; /* drop if queue full and no callback */
>       }
> +
> +    assert(size <= NET_BUFSIZE);
>       packet = g_malloc(sizeof(NetPacket) + size);
>       packet->sender = sender;
>       packet->flags = flags;
> @@ -131,6 +133,7 @@ void qemu_net_queue_append_iov(NetQueue *queue,
>           max_len += iov[i].iov_len;
>       }
>   
> +    assert(max_len <= NET_BUFSIZE);
>       packet = g_malloc(sizeof(NetPacket) + max_len);
>       packet->sender = sender;
>       packet->sent_cb = sent_cb;


Anyway to avoid the assert here?

Thanks

Patch

diff --git a/net/queue.c b/net/queue.c
index 221a1c87961..94b98b19ef9 100644
--- a/net/queue.c
+++ b/net/queue.c
@@ -102,6 +102,8 @@  static void qemu_net_queue_append(NetQueue *queue,
     if (queue->nq_count >= queue->nq_maxlen && !sent_cb) {
         return; /* drop if queue full and no callback */
     }
+
+    assert(size <= NET_BUFSIZE);
     packet = g_malloc(sizeof(NetPacket) + size);
     packet->sender = sender;
     packet->flags = flags;
@@ -131,6 +133,7 @@  void qemu_net_queue_append_iov(NetQueue *queue,
         max_len += iov[i].iov_len;
     }
 
+    assert(max_len <= NET_BUFSIZE);
     packet = g_malloc(sizeof(NetPacket) + max_len);
     packet->sender = sender;
     packet->sent_cb = sent_cb;