Series comparison

-[PULL 0/5] Net patches
+[PULL 00/13] Net patches
-The following changes since commit 23895cbd82be95428e90168b12e925d0d3ca2f06:
+The following changes since commit bdee969c0e65d4d509932b1d70e3a3b2ffbff6d5:
-  Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201123.0' into staging (2020-11-23 18:51:13 +0000)
+  Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-03-19 18:01:17 +0000)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to 9925990d01a92564af55f6f69d0f5f59b47609b1:
+for you to fetch changes up to c7274b5ef43614dd133daec1e2018f71d8744088:
-  net: Use correct default-path macro for downscript (2020-11-24 10:40:17 +0800)
+  net/eth: Add an assert() and invert if() statement to simplify code (2021-03-22 17:34:31 +0800)
 ----------------------------------------------------------------
 ----------------------------------------------------------------
-Keqian Zhu (1):
+Bin Meng (4):
-      net: Use correct default-path macro for downscript
+      net: eth: Add a helper to pad a short Ethernet frame
       net: Add a 'do_not_pad" to NetClientState
       net: Pad short frames to minimum size before sending from SLiRP/TAP
       hw/net: virtio-net: Initialize nc->do_not_pad to true
-Paolo Bonzini (1):
+Lukas Straub (2):
-      net: do not exit on "netdev_add help" monitor command
+      net/colo-compare.c: Fix memory leak for non-tcp packet
       net/colo-compare.c: Optimize removal of secondary packet
-Prasad J Pandit (1):
+Philippe Mathieu-Daudé (7):
-      hw/net/e1000e: advance desc_offset in case of null descriptor
+      net/eth: Use correct in6_address offset in _eth_get_rss_ex_dst_addr()
       net/eth: Simplify _eth_get_rss_ex_dst_addr()
       net/eth: Better describe _eth_get_rss_ex_dst_addr's offset argument
       net/eth: Check size earlier in _eth_get_rss_ex_dst_addr()
       net/eth: Check iovec has enough data earlier
       net/eth: Read ip6_ext_hdr_routing buffer before accessing it
       net/eth: Add an assert() and invert if() statement to simplify code
-Yuri Benditovich (1):
+ MAINTAINERS                    |  1 +
-      net: purge queued rx packets on queue deletion
+ hw/net/virtio-net.c            |  4 +++
+ include/net/eth.h              | 17 ++++++++++++
-yuanjungong (1):
+ include/net/net.h              |  1 +
-      tap: fix a memory leak
+ net/colo-compare.c             |  3 ++-
+ net/eth.c                      | 61 +++++++++++++++++++++++++++---------------
- hw/net/e1000e_core.c |  8 +++---
+ net/slirp.c                    | 10 +++++++
- include/net/net.h    |  1 +
+ net/tap-win32.c                | 10 +++++++
- monitor/hmp-cmds.c   |  6 ++++
+ net/tap.c                      | 10 +++++++
- net/net.c            | 80 +++++++++++++++++++++++++++-------------------------
+ tests/qtest/fuzz-e1000e-test.c | 53 ++++++++++++++++++++++++++++++++++++
- net/tap.c            |  5 +++-
+ tests/qtest/meson.build        |  1 +
-files changed, 57 insertions(+), 43 deletions(-)
+files changed, 148 insertions(+), 23 deletions(-)
  create mode 100644 tests/qtest/fuzz-e1000e-test.c

-New patch
+[PULL 01/13] net: eth: Add a helper to pad a short Ethernet frame
+From: Bin Meng <bmeng.cn@gmail.com>
+Add a helper to pad a short Ethernet frame to the minimum required
+length, which can be used by backends' code.
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ include/net/eth.h | 17 +++++++++++++++++
+ net/eth.c         | 17 +++++++++++++++++
+files changed, 34 insertions(+)
+diff --git a/include/net/eth.h b/include/net/eth.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/net/eth.h
++++ b/include/net/eth.h
+@@ -XXX,XX +XXX,XX @@
+ #define ETH_ALEN 6
+ #define ETH_HLEN 14
++#define ETH_ZLEN 60     /* Min. octets in frame without FCS */
+ struct eth_header {
+     uint8_t  h_dest[ETH_ALEN];   /* destination eth addr */
+@@ -XXX,XX +XXX,XX @@ bool
+ eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
+                    size_t ip6hdr_off, eth_ip6_hdr_info *info);
++/**
++ * eth_pad_short_frame - pad a short frame to the minimum Ethernet frame length
++ *
++ * If the Ethernet frame size is shorter than 60 bytes, it will be padded to
++ * 60 bytes at the address @padded_pkt.
++ *
++ * @padded_pkt: buffer address to hold the padded frame
++ * @padded_buflen: pointer holding length of @padded_pkt. If the frame is
++ *                 padded, the length will be updated to the padded one.
++ * @pkt: address to hold the original Ethernet frame
++ * @pkt_size: size of the original Ethernet frame
++ * @return true if the frame is padded, otherwise false
++ */
++bool eth_pad_short_frame(uint8_t *padded_pkt, size_t *padded_buflen,
++                         const void *pkt, size_t pkt_size);
++
+ #endif
+diff --git a/net/eth.c b/net/eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -XXX,XX +XXX,XX @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
+     info->l4proto = ext_hdr.ip6r_nxt;
+     return true;
+ }
++
++bool eth_pad_short_frame(uint8_t *padded_pkt, size_t *padded_buflen,
++                         const void *pkt, size_t pkt_size)
++{
++    assert(padded_buflen && *padded_buflen >= ETH_ZLEN);
++
++    if (pkt_size >= ETH_ZLEN) {
++        return false;
++    }
++
++    /* pad to minimum Ethernet frame length */
++    memcpy(padded_pkt, pkt, pkt_size);
++    memset(&padded_pkt[pkt_size], 0, ETH_ZLEN - pkt_size);
++    *padded_buflen = ETH_ZLEN;
++
++    return true;
++}
+--
+.7.4

-[PULL 2/5] net: do not exit on "netdev_add help" monitor command
+[PULL 02/13] net: Add a 'do_not_pad" to NetClientState
-From: Paolo Bonzini <pbonzini@redhat.com>
+From: Bin Meng <bmeng.cn@gmail.com>
-"netdev_add help" is causing QEMU to exit because the code that
+This adds a flag in NetClientState, so that a net client can tell
-invokes show_netdevs is shared between CLI and HMP processing.
+its peer that the packets do not need to be padded to the minimum
-Move the check to the callers so that exit(0) remains only
+size of an Ethernet frame (60 bytes) before sending to it.
 in the CLI flow.
-"netdev_add help" is not fixed by this patch; that is left for
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-later work.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- include/net/net.h  |  1 +
+ include/net/net.h | 1 +
- monitor/hmp-cmds.c |  6 +++++
+file changed, 1 insertion(+)
  net/net.c          | 68 +++++++++++++++++++++++++++---------------------------
 files changed, 41 insertions(+), 34 deletions(-)
 diff --git a/include/net/net.h b/include/net/net.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/net/net.h
 +++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ extern const char *host_net_devices[];
+@@ -XXX,XX +XXX,XX @@ struct NetClientState {
+     int vring_enable;
- /* from net.c */
+     int vnet_hdr_len;
- int net_client_parse(QemuOptsList *opts_list, const char *str);
+     bool is_netdev;
-+void show_netdevs(void);
++    bool do_not_pad; /* do not pad to the minimum ethernet frame length */
- int net_init_clients(Error **errp);
+     QTAILQ_HEAD(, NetFilterState) filters;
- void net_check_clients(void);
+ };
  void net_cleanup(void);
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index XXXXXXX..XXXXXXX 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/option.h"
  #include "qemu/timer.h"
  #include "qemu/sockets.h"
 +#include "qemu/help_option.h"
  #include "monitor/monitor-internal.h"
  #include "qapi/error.h"
  #include "qapi/clone-visitor.h"
@@ -XXX,XX +XXX,XX @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict)
  {
      Error *err = NULL;
      QemuOpts *opts;
 +    const char *type = qdict_get_try_str(qdict, "type");
 +    if (type && is_help_option(type)) {
 +        show_netdevs();
 +        return;
 +    }
      opts = qemu_opts_from_qdict(qemu_find_opts("netdev"), qdict, &err);
      if (err) {
          goto out;
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/config-file.h"
  #include "qemu/ctype.h"
  #include "qemu/iov.h"
 +#include "qemu/qemu-print.h"
  #include "qemu/main-loop.h"
  #include "qemu/option.h"
  #include "qapi/error.h"
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
      return 0;
  }
 -static void show_netdevs(void)
 +void show_netdevs(void)
  {
      int idx;
      const char *available_netdevs[] = {
@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
  #endif
      };
 -    printf("Available netdev backend types:\n");
 +    qemu_printf("Available netdev backend types:\n");
      for (idx = 0; idx < ARRAY_SIZE(available_netdevs); idx++) {
 -        puts(available_netdevs[idx]);
 +        qemu_printf("%s\n", available_netdevs[idx]);
      }
  }
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
      int ret = -1;
      Visitor *v = opts_visitor_new(opts);
 -    const char *type = qemu_opt_get(opts, "type");
 -
 -    if (is_netdev && type && is_help_option(type)) {
 -        show_netdevs();
 -        exit(0);
 -    } else {
 -        /* Parse convenience option format ip6-net=fec0::0[/64] */
 -        const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
 +    /* Parse convenience option format ip6-net=fec0::0[/64] */
 +    const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
 -        if (ip6_net) {
 -            char *prefix_addr;
 -            unsigned long prefix_len = 64; /* Default 64bit prefix length. */
 +    if (ip6_net) {
 +        char *prefix_addr;
 +        unsigned long prefix_len = 64; /* Default 64bit prefix length. */
 -            substrings = g_strsplit(ip6_net, "/", 2);
 -            if (!substrings || !substrings[0]) {
 -                error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
 -                           "a valid IPv6 prefix");
 -                goto out;
 -            }
 +        substrings = g_strsplit(ip6_net, "/", 2);
 +        if (!substrings || !substrings[0]) {
 +            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
 +                       "a valid IPv6 prefix");
 +            goto out;
 +        }
 -            prefix_addr = substrings[0];
 +        prefix_addr = substrings[0];
 -            /* Handle user-specified prefix length. */
 -            if (substrings[1] &&
 -                qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
 -            {
 -                error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
 -                           "ipv6-prefixlen", "a number");
 -                goto out;
 -            }
 -
 -            qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
 -            qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
 -                                &error_abort);
 -            qemu_opt_unset(opts, "ipv6-net");
 +        /* Handle user-specified prefix length. */
 +        if (substrings[1] &&
 +            qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
 +        {
 +            error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
 +                       "ipv6-prefixlen", "a number");
 +            goto out;
          }
 +
 +        qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
 +        qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
 +                            &error_abort);
 +        qemu_opt_unset(opts, "ipv6-net");
      }
      /* Create an ID for -net if the user did not specify one */
@@ -XXX,XX +XXX,XX @@ static int net_init_client(void *dummy, QemuOpts *opts, Error **errp)
  static int net_init_netdev(void *dummy, QemuOpts *opts, Error **errp)
  {
 +    const char *type = qemu_opt_get(opts, "type");
 +
 +    if (type && is_help_option(type)) {
 +        show_netdevs();
 +        exit(0);
 +    }
      return net_client_init(opts, true, errp);
  }
 --
 .7.4

-[PULL 4/5] tap: fix a memory leak
+[PULL 03/13] net: Pad short frames to minimum size before sending from SLiRP/TAP
-From: yuanjungong <ruc_gongyuanjun@163.com>
+From: Bin Meng <bmeng.cn@gmail.com>
-Close fd before returning.
+The minimum Ethernet frame length is 60 bytes. For short frames with
 smaller length like ARP packets (only 42 bytes), on a real world NIC
 it can choose either padding its length to the minimum required 60
 bytes, or sending it out directly to the wire. Such behavior can be
 hardcoded or controled by a register bit. Similarly on the receive
 path, NICs can choose either dropping such short frames directly or
 handing them over to software to handle.
-Buglink: https://bugs.launchpad.net/qemu/+bug/1904486
+On the other hand, for the network backends like SLiRP/TAP, they
 don't expose a way to control the short frame behavior. As of today
 they just send/receive data from/to the other end connected to them,
 which means any sized packet is acceptable. So they can send and
 receive short frames without any problem. It is observed that ARP
 packets sent from SLiRP/TAP are 42 bytes, and SLiRP/TAP just send
 these ARP packets to the other end which might be a NIC model that
 does not allow short frames to pass through.
-Signed-off-by: yuanjungong <ruc_gongyuanjun@163.com>
+To provide better compatibility, for packets sent from QEMU network
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+backends like SLiRP/TAP, we change to pad short frames before sending
 it out to the other end, if the other end does not forbid it via the
 nc->do_not_pad flag. This ensures a backend as an Ethernet sender
 does not violate the spec. But with this change, the behavior of
 dropping short frames from SLiRP/TAP interfaces in the NIC model
 cannot be emulated because it always receives a packet that is spec
 complaint. The capability of sending short frames from NIC models is
 still supported and short frames can still pass through SLiRP/TAP.
 This commit should be able to fix the issue as reported with some
 NIC models before, that ARP requests get dropped, preventing the
 guest from becoming visible on the network. It was workarounded in
 these NIC models on the receive path, that when a short frame is
 received, it is padded up to 60 bytes.
 The following 2 commits seem to be the one to workaround this issue
 in e1000 and vmxenet3 before, and should probably be reverted.
   commit 78aeb23eded2 ("e1000: Pad short frames to minimum size (60 bytes)")
   commit 40a87c6c9b11 ("vmxnet3: Pad short frames to minimum size (60 bytes)")
 Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/tap.c | 2 ++
+ net/slirp.c     | 10 ++++++++++
-file changed, 2 insertions(+)
+ net/tap-win32.c | 10 ++++++++++
  net/tap.c       | 10 ++++++++++
 files changed, 30 insertions(+)
+diff --git a/net/slirp.c b/net/slirp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/slirp.c
++++ b/net/slirp.c
+@@ -XXX,XX +XXX,XX @@
+ #include <pwd.h>
+ #include <sys/wait.h>
+ #endif
++#include "net/eth.h"
+ #include "net/net.h"
+ #include "clients.h"
+ #include "hub.h"
+@@ -XXX,XX +XXX,XX @@ static ssize_t net_slirp_send_packet(const void *pkt, size_t pkt_len,
+                                      void *opaque)
+ {
+     SlirpState *s = opaque;
++    uint8_t min_pkt[ETH_ZLEN];
++    size_t min_pktsz = sizeof(min_pkt);
++
++    if (!s->nc.peer->do_not_pad) {
++        if (eth_pad_short_frame(min_pkt, &min_pktsz, pkt, pkt_len)) {
++            pkt = min_pkt;
++            pkt_len = min_pktsz;
++        }
++    }
+     return qemu_send_packet(&s->nc, pkt, pkt_len);
+ }
+diff --git a/net/tap-win32.c b/net/tap-win32.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/tap-win32.c
++++ b/net/tap-win32.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "clients.h"            /* net_init_tap */
++#include "net/eth.h"
+ #include "net/net.h"
+ #include "net/tap.h"            /* tap_has_ufo, ... */
+ #include "qemu/error-report.h"
+@@ -XXX,XX +XXX,XX @@ static void tap_win32_send(void *opaque)
+     uint8_t *buf;
+     int max_size = 4096;
+     int size;
++    uint8_t min_pkt[ETH_ZLEN];
++    size_t min_pktsz = sizeof(min_pkt);
+     size = tap_win32_read(s->handle, &buf, max_size);
+     if (size > 0) {
++        if (!s->nc.peer->do_not_pad) {
++            if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
++                buf = min_pkt;
++                size = min_pktsz;
++            }
++        }
++
+         qemu_send_packet(&s->nc, buf, size);
+         tap_win32_free_buffer(s->handle, buf);
+     }
 diff --git a/net/tap.c b/net/tap.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap.c
 +++ b/net/tap.c
-@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
+@@ -XXX,XX +XXX,XX @@
-         if (ret < 0) {
+ #include <sys/socket.h>
-             error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
+ #include <net/if.h>
-                              name, fd);
-+            close(fd);
++#include "net/eth.h"
-             return -1;
+ #include "net/net.h"
  #include "clients.h"
  #include "monitor/monitor.h"
@@ -XXX,XX +XXX,XX @@ static void tap_send(void *opaque)
      while (true) {
          uint8_t *buf = s->buf;
 +        uint8_t min_pkt[ETH_ZLEN];
 +        size_t min_pktsz = sizeof(min_pkt);
          size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
          if (size <= 0) {
@@ -XXX,XX +XXX,XX @@ static void tap_send(void *opaque)
              size -= s->host_vnet_hdr_len;
          }
-@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
++        if (!s->nc.peer->do_not_pad) {
-                          vhostfdname, vnet_hdr, fd, &err);
++            if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
-         if (err) {
++                buf = min_pkt;
-             error_propagate(errp, err);
++                size = min_pktsz;
-+            close(fd);
++            }
-             return -1;
++        }
-         }
++
-     } else if (tap->has_fds) {
+         size = qemu_send_packet_async(&s->nc, buf, size, tap_send_completed);
          if (size == 0) {
              tap_read_poll(s, false);
 --
 .7.4

-New patch
+[PULL 04/13] hw/net: virtio-net: Initialize nc->do_not_pad to true
+From: Bin Meng <bmeng.cn@gmail.com>
+For virtio-net, there is no need to pad the Ethernet frame size to
+bytes before sending to it.
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/virtio-net.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
+                               object_get_typename(OBJECT(dev)), dev->id, n);
+     }
++    for (i = 0; i < n->max_queues; i++) {
++        n->nic->ncs[i].do_not_pad = true;
++    }
++
+     peer_test_vnet_hdr(n);
+     if (peer_has_vnet_hdr(n)) {
+         for (i = 0; i < n->max_queues; i++) {
+--
+.7.4

-New patch
+[PULL 05/13] net/colo-compare.c: Fix memory leak for non-tcp packet
+From: Lukas Straub <lukasstraub2@web.de>
+Additional to removing the packet from the secondary queue,
+we also need to free it.
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/colo-compare.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/net/colo-compare.c b/net/colo-compare.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/colo-compare.c
++++ b/net/colo-compare.c
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
+         if (result) {
+             colo_release_primary_pkt(s, pkt);
++            packet_destroy(result->data, NULL);
+             g_queue_remove(&conn->secondary_list, result->data);
+         } else {
+             /*
+--
+.7.4

-New patch
+[PULL 06/13] net/colo-compare.c: Optimize removal of secondary packet
+From: Lukas Straub <lukasstraub2@web.de>
+g_queue_remove needs to look up the list entry first, but we
+already have it as result and can remove it directly with
+g_queue_delete_link.
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/colo-compare.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/net/colo-compare.c b/net/colo-compare.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/colo-compare.c
++++ b/net/colo-compare.c
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
+         if (result) {
+             colo_release_primary_pkt(s, pkt);
+             packet_destroy(result->data, NULL);
+-            g_queue_remove(&conn->secondary_list, result->data);
++            g_queue_delete_link(&conn->secondary_list, result);
+         } else {
+             /*
+              * If one packet arrive late, the secondary_list or
+--
+.7.4

-New patch
+[PULL 07/13] net/eth: Use correct in6_address offset in _eth_get_rss_ex_dst_addr()
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+The in6_address comes after the ip6_ext_hdr_routing header,
+not after the ip6_ext_hdr one. Fix the offset.
+Cc: qemu-stable@nongnu.org
+Reported-by: Stefano Garzarella <sgarzare@redhat.com>
+Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/eth.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/net/eth.c b/net/eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+         }
+         bytes_read = iov_to_buf(pkt, pkt_frags,
+-                                rthdr_offset + sizeof(*ext_hdr),
++                                rthdr_offset + sizeof(*rthdr),
+                                 dst_addr, sizeof(*dst_addr));
+         return bytes_read == sizeof(*dst_addr);
+--
+.7.4

-New patch
+[PULL 08/13] net/eth: Simplify _eth_get_rss_ex_dst_addr()
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+The length field is already contained in the ip6_ext_hdr structure.
+Check it direcly in eth_parse_ipv6_hdr() before calling
+_eth_get_rss_ex_dst_addr(), which gets a bit simplified.
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/eth.c | 14 +++++++-------
+file changed, 7 insertions(+), 7 deletions(-)
+diff --git a/net/eth.c b/net/eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+ {
+     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
+-    if ((rthdr->rtype == 2) &&
+-        (rthdr->len == sizeof(struct in6_address) / 8) &&
+-        (rthdr->segleft == 1)) {
++    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
+         size_t input_size = iov_size(pkt, pkt_frags);
+         size_t bytes_read;
+@@ -XXX,XX +XXX,XX @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
+         }
+         if (curr_ext_hdr_type == IP6_ROUTING) {
+-            info->rss_ex_dst_valid =
+-                _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
+-                                         ip6hdr_off + info->full_hdr_len,
+-                                         &ext_hdr, &info->rss_ex_dst);
++            if (ext_hdr.ip6r_len == sizeof(struct in6_address) / 8) {
++                info->rss_ex_dst_valid =
++                    _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
++                                             ip6hdr_off + info->full_hdr_len,
++                                             &ext_hdr, &info->rss_ex_dst);
++            }
+         } else if (curr_ext_hdr_type == IP6_DESTINATON) {
+             info->rss_ex_src_valid =
+                 _eth_get_rss_ex_src_addr(pkt, pkt_frags,
+--
+.7.4

-New patch
+[PULL 09/13] net/eth: Better describe _eth_get_rss_ex_dst_addr's offset argument
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+The 'offset' argument represents the offset to the ip6_ext_hdr
+header, rename it as 'ext_hdr_offset'.
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/eth.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/net/eth.c b/net/eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -XXX,XX +XXX,XX @@ eth_is_ip6_extension_header_type(uint8_t hdr_type)
+ static bool
+ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+-                        size_t rthdr_offset,
++                        size_t ext_hdr_offset,
+                         struct ip6_ext_hdr *ext_hdr,
+                         struct in6_address *dst_addr)
+ {
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+         size_t input_size = iov_size(pkt, pkt_frags);
+         size_t bytes_read;
+-        if (input_size < rthdr_offset + sizeof(*ext_hdr)) {
++        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
+             return false;
+         }
+         bytes_read = iov_to_buf(pkt, pkt_frags,
+-                                rthdr_offset + sizeof(*rthdr),
++                                ext_hdr_offset + sizeof(*rthdr),
+                                 dst_addr, sizeof(*dst_addr));
+         return bytes_read == sizeof(*dst_addr);
+--
+.7.4

-New patch
+[PULL 10/13] net/eth: Check size earlier in _eth_get_rss_ex_dst_addr()
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/eth.c | 14 ++++++--------
+file changed, 6 insertions(+), 8 deletions(-)
+diff --git a/net/eth.c b/net/eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+                         struct in6_address *dst_addr)
+ {
+     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
++    size_t input_size = iov_size(pkt, pkt_frags);
++    size_t bytes_read;
+-    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
+-
+-        size_t input_size = iov_size(pkt, pkt_frags);
+-        size_t bytes_read;
+-
+-        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
+-            return false;
+-        }
++    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
++        return false;
++    }
++    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
+         bytes_read = iov_to_buf(pkt, pkt_frags,
+                                 ext_hdr_offset + sizeof(*rthdr),
+                                 dst_addr, sizeof(*dst_addr));
+--
+.7.4

-[PULL 3/5] net: purge queued rx packets on queue deletion
+[PULL 11/13] net/eth: Check iovec has enough data earlier
-From: Yuri Benditovich <yuri.benditovich@daynix.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-https://bugzilla.redhat.com/show_bug.cgi?id=1829272
+We want to check fields from ip6_ext_hdr_routing structure
-When deleting queue pair, purge pending RX packets if any.
+and if correct read the full in6_address. Let's directly check
-Example of problematic flow:
+if our iovec contains enough data for everything, else return
-. Bring up q35 VM with tap (vhost off) and virtio-net or e1000e
+early.
 . Run ping flood to the VM NIC ( 1 ms interval)
 . Hot unplug the NIC device (device_del)
    During unplug process one or more packets come, the NIC
    can't receive, tap disables read_poll
 . Hot plug the device (device_add) with the same netdev
 The tap stays with read_poll disabled and does not receive
 any packets anymore (tap_send never triggered)
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
 Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/net.c | 12 ++++++++----
+ net/eth.c | 2 +-
-file changed, 8 insertions(+), 4 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/net/net.c b/net/net.c
+diff --git a/net/eth.c b/net/eth.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/net.c
+--- a/net/eth.c
-+++ b/net/net.c
++++ b/net/eth.c
-@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+     size_t input_size = iov_size(pkt, pkt_frags);
-     qemu_macaddr_set_free(&nic->conf->macaddr);
+     size_t bytes_read;
--    /* If this is a peer NIC and peer has already been deleted, free it now. */
+-    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
--    if (nic->peer_deleted) {
++    if (input_size < ext_hdr_offset + sizeof(*rthdr) + sizeof(*dst_addr)) {
--        for (i = 0; i < queues; i++) {
+         return false;
 -            qemu_free_net_client(qemu_get_subqueue(nic, i)->peer);
 +    for (i = 0; i < queues; i++) {
 +        NetClientState *nc = qemu_get_subqueue(nic, i);
 +        /* If this is a peer NIC and peer has already been deleted, free it now. */
 +        if (nic->peer_deleted) {
 +            qemu_free_net_client(nc->peer);
 +        } else if (nc->peer) {
 +            /* if there are RX packets pending, complete them */
 +            qemu_purge_queued_packets(nc->peer);
          }
      }
 --
 .7.4

-[PULL 5/5] net: Use correct default-path macro for downscript
+[PULL 12/13] net/eth: Read ip6_ext_hdr_routing buffer before accessing it
-From: Keqian Zhu <zhukeqian1@huawei.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Fixes: 63c4db4c2e6d (net: relocate paths to helpers and scripts)
+We can't know the caller read enough data in the memory pointed
-Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+by ext_hdr to cast it as a ip6_ext_hdr_routing.
 Declare rt_hdr on the stack and fill it again from the iovec.
 Since we already checked there is enough data in the iovec buffer,
 simply add an assert() call to consume the bytes_read variable.
 This fix a 2 bytes buffer overrun in eth_parse_ipv6_hdr() reported
 by QEMU fuzzer:
   $ cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 \
     -accel qtest -monitor none \
     -serial none -nographic -qtest stdio
   outl 0xcf8 0x80001010
   outl 0xcfc 0xe1020000
   outl 0xcf8 0x80001004
   outw 0xcfc 0x7
   write 0x25 0x1 0x86
   write 0x26 0x1 0xdd
   write 0x4f 0x1 0x2b
   write 0xe1020030 0x4 0x190002e1
   write 0xe102003a 0x2 0x0807
   write 0xe1020048 0x4 0x12077cdd
   write 0xe1020400 0x4 0xba077cdd
   write 0xe1020420 0x4 0x190002e1
   write 0xe1020428 0x4 0x3509d807
   write 0xe1020438 0x1 0xe2
   EOF
   =================================================================
   ==2859770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdef904902 at pc 0x561ceefa78de bp 0x7ffdef904820 sp 0x7ffdef904818
   READ of size 1 at 0x7ffdef904902 thread T0
       #0 0x561ceefa78dd in _eth_get_rss_ex_dst_addr net/eth.c:410:17
       #1 0x561ceefa41fb in eth_parse_ipv6_hdr net/eth.c:532:17
       #2 0x561cef7de639 in net_tx_pkt_parse_headers hw/net/net_tx_pkt.c:228:14
       #3 0x561cef7dbef4 in net_tx_pkt_parse hw/net/net_tx_pkt.c:273:9
       #4 0x561ceec29f22 in e1000e_process_tx_desc hw/net/e1000e_core.c:730:29
       #5 0x561ceec28eac in e1000e_start_xmit hw/net/e1000e_core.c:927:9
       #6 0x561ceec1baab in e1000e_set_tdt hw/net/e1000e_core.c:2444:9
       #7 0x561ceebf300e in e1000e_core_write hw/net/e1000e_core.c:3256:9
       #8 0x561cef3cd4cd in e1000e_mmio_write hw/net/e1000e.c:110:5
   Address 0x7ffdef904902 is located in stack of thread T0 at offset 34 in frame
       #0 0x561ceefa320f in eth_parse_ipv6_hdr net/eth.c:486
     This frame has 1 object(s):
       [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable
   HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
         (longjmp and C++ exceptions *are* supported)
   SUMMARY: AddressSanitizer: stack-buffer-overflow net/eth.c:410:17 in _eth_get_rss_ex_dst_addr
   Shadow bytes around the buggy address:
 x10003df188d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df188e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df188f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18910: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
   =>0x10003df18920:[02]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   Shadow byte legend (one shadow byte represents 8 application bytes):
     Addressable:           00
     Partially addressable: 01 02 03 04 05 06 07
     Stack left redzone:      f1
     Stack right redzone:     f3
   ==2859770==ABORTING
 Add the corresponding qtest case with the fuzzer reproducer.
 FWIW GCC 11 similarly reported:
   net/eth.c: In function 'eth_parse_ipv6_hdr':
   net/eth.c:410:15: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
         |          ~~~~~^~~~~~~
   net/eth.c:485:24: note: while referencing 'ext_hdr'
 |     struct ip6_ext_hdr ext_hdr;
         |                        ^~~~~~~
   net/eth.c:410:38: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
         |                                 ~~~~~^~~~~~~~~
   net/eth.c:485:24: note: while referencing 'ext_hdr'
 |     struct ip6_ext_hdr ext_hdr;
         |                        ^~~~~~~
 Cc: qemu-stable@nongnu.org
 Buglink: https://bugs.launchpad.net/qemu/+bug/1879531
 Reported-by: Alexander Bulekov <alxndr@bu.edu>
 Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
 Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
 Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
 Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/tap.c | 3 ++-
+ MAINTAINERS                    |  1 +
-file changed, 2 insertions(+), 1 deletion(-)
+ net/eth.c                      | 13 +++++++----
+ tests/qtest/fuzz-e1000e-test.c | 53 ++++++++++++++++++++++++++++++++++++++++++
-diff --git a/net/tap.c b/net/tap.c
+ tests/qtest/meson.build        |  1 +
 files changed, 63 insertions(+), 5 deletions(-)
  create mode 100644 tests/qtest/fuzz-e1000e-test.c
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/net/tap.c
+--- a/MAINTAINERS
-+++ b/net/tap.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ free_fail:
+@@ -XXX,XX +XXX,XX @@ e1000e
-             script = default_script = get_relocated_path(DEFAULT_NETWORK_SCRIPT);
+ M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
-         }
+ S: Maintained
-         if (!downscript) {
+ F: hw/net/e1000e*
--            downscript = default_downscript = get_relocated_path(DEFAULT_NETWORK_SCRIPT);
++F: tests/qtest/fuzz-e1000e-test.c
-+            downscript = default_downscript =
-+                                 get_relocated_path(DEFAULT_NETWORK_DOWN_SCRIPT);
+ eepro100
-         }
+ M: Stefan Weil <sw@weilnetz.de>
+diff --git a/net/eth.c b/net/eth.c
-         if (tap->has_ifname) {
+index XXXXXXX..XXXXXXX 100644
 --- a/net/eth.c
 +++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                          struct ip6_ext_hdr *ext_hdr,
                          struct in6_address *dst_addr)
  {
 -    struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
 +    struct ip6_ext_hdr_routing rt_hdr;
      size_t input_size = iov_size(pkt, pkt_frags);
      size_t bytes_read;
 -    if (input_size < ext_hdr_offset + sizeof(*rthdr) + sizeof(*dst_addr)) {
 +    if (input_size < ext_hdr_offset + sizeof(rt_hdr) + sizeof(*dst_addr)) {
          return false;
      }
 -    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
 -        bytes_read = iov_to_buf(pkt, pkt_frags,
 -                                ext_hdr_offset + sizeof(*rthdr),
 +    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
 +                            &rt_hdr, sizeof(rt_hdr));
 +    assert(bytes_read == sizeof(rt_hdr));
 +
 +    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
 +        bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
                                  dst_addr, sizeof(*dst_addr));
          return bytes_read == sizeof(*dst_addr);
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qtest/fuzz-e1000e-test.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QTest testcase for e1000e device generated by fuzzer
 + *
 + * Copyright (c) 2021 Red Hat, Inc.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +
 +#include "libqos/libqtest.h"
 +
 +/*
 + * https://bugs.launchpad.net/qemu/+bug/1879531
 + */
 +static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 +{
 +    QTestState *s;
 +
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +
 +    qtest_outl(s, 0xcf8, 0x80001010);
 +    qtest_outl(s, 0xcfc, 0xe1020000);
 +    qtest_outl(s, 0xcf8, 0x80001004);
 +    qtest_outw(s, 0xcfc, 0x7);
 +    qtest_writeb(s, 0x25, 0x86);
 +    qtest_writeb(s, 0x26, 0xdd);
 +    qtest_writeb(s, 0x4f, 0x2b);
 +
 +    qtest_writel(s, 0xe1020030, 0x190002e1);
 +    qtest_writew(s, 0xe102003a, 0x0807);
 +    qtest_writel(s, 0xe1020048, 0x12077cdd);
 +    qtest_writel(s, 0xe1020400, 0xba077cdd);
 +    qtest_writel(s, 0xe1020420, 0x190002e1);
 +    qtest_writel(s, 0xe1020428, 0x3509d807);
 +    qtest_writeb(s, 0xe1020438, 0xe2);
 +    qtest_writeb(s, 0x4f, 0x2b);
 +    qtest_quit(s);
 +}
 +
 +int main(int argc, char **argv)
 +{
 +    const char *arch = qtest_get_arch();
 +
 +    g_test_init(&argc, &argv, NULL);
 +
 +    if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
 +        qtest_add_func("fuzz/test_lp1879531_eth_get_rss_ex_dst_addr",
 +                       test_lp1879531_eth_get_rss_ex_dst_addr);
 +    }
 +
 +    return g_test_run();
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
    (config_all_devices.has_key('CONFIG_TPM_TIS_ISA') ? ['tpm-tis-test'] : []) +              \
    (config_all_devices.has_key('CONFIG_TPM_TIS_ISA') ? ['tpm-tis-swtpm-test'] : []) +        \
    (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
 +  (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
    qtests_pci +                                                                              \
    ['fdc-test',
     'ide-test',
 --
 .7.4

-[PULL 1/5] hw/net/e1000e: advance desc_offset in case of null descriptor
+[PULL 13/13] net/eth: Add an assert() and invert if() statement to simplify code
-From: Prasad J Pandit <pjp@fedoraproject.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-While receiving packets via e1000e_write_packet_to_guest() routine,
+To simplify the function body, invert the if() statement, returning
-'desc_offset' is advanced only when RX descriptor is processed. And
+earlier.
-RX descriptor is not processed if it has NULL buffer address.
+Since we already checked there is enough data in the iovec buffer,
-This may lead to an infinite loop condition. Increament 'desc_offset'
+simply add an assert() call to consume the bytes_read variable.
 to process next descriptor in the ring to avoid infinite loop.
-Reported-by: Cheol-woo Myung <330cjfdn@gmail.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/e1000e_core.c | 8 ++++----
+ net/eth.c | 13 ++++++-------
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 6 insertions(+), 7 deletions(-)
-diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
+diff --git a/net/eth.c b/net/eth.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/e1000e_core.c
+--- a/net/eth.c
-+++ b/hw/net/e1000e_core.c
++++ b/net/eth.c
-@@ -XXX,XX +XXX,XX @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
-                           (const char *) &fcs_pad, e1000x_fcs_len(core->mac));
+     bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
-                 }
+                             &rt_hdr, sizeof(rt_hdr));
-             }
+     assert(bytes_read == sizeof(rt_hdr));
--            desc_offset += desc_size;
+-
--            if (desc_offset >= total_size) {
+-    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
--                is_last = true;
+-        bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
--            }
+-                                dst_addr, sizeof(*dst_addr));
-         } else { /* as per intel docs; skip descriptors with null buf addr */
+-
-             trace_e1000e_rx_null_descriptor();
+-        return bytes_read == sizeof(*dst_addr);
-         }
++    if ((rt_hdr.rtype != 2) || (rt_hdr.segleft != 1)) {
-+        desc_offset += desc_size;
++        return false;
-+        if (desc_offset >= total_size) {
+     }
-+            is_last = true;
++    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
-+        }
++                            dst_addr, sizeof(*dst_addr));
++    assert(bytes_read == sizeof(*dst_addr));
-         e1000e_write_rx_descr(core, desc, is_last ? core->rx_pkt : NULL,
-                            rss_info, do_ps ? ps_hdr_len : 0, &bastate.written);
+-    return false;
 +    return true;
  }
  static bool
 --
 .7.4

The following changes since commit 23895cbd82be95428e90168b12e925d0d3ca2f06:

Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201123.0' into staging (2020-11-23 18:51:13 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 9925990d01a92564af55f6f69d0f5f59b47609b1:

net: Use correct default-path macro for downscript (2020-11-24 10:40:17 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Keqian Zhu (1):
      net: Use correct default-path macro for downscript

Paolo Bonzini (1):
      net: do not exit on "netdev_add help" monitor command

Prasad J Pandit (1):
      hw/net/e1000e: advance desc_offset in case of null descriptor

Yuri Benditovich (1):
      net: purge queued rx packets on queue deletion

yuanjungong (1):
      tap: fix a memory leak

From: Prasad J Pandit <pjp@fedoraproject.org>

While receiving packets via e1000e_write_packet_to_guest() routine,
'desc_offset' is advanced only when RX descriptor is processed. And
RX descriptor is not processed if it has NULL buffer address.
This may lead to an infinite loop condition. Increament 'desc_offset'
to process next descriptor in the ring to avoid infinite loop.

Reported-by: Cheol-woo Myung <330cjfdn@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -XXX,XX +XXX,XX @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
                           (const char *) &fcs_pad, e1000x_fcs_len(core->mac));
                 }
             }
-            desc_offset += desc_size;
-            if (desc_offset >= total_size) {
-                is_last = true;
-            }
         } else { /* as per intel docs; skip descriptors with null buf addr */
             trace_e1000e_rx_null_descriptor();
         }
+        desc_offset += desc_size;
+        if (desc_offset >= total_size) {
+            is_last = true;
+        }
 
         e1000e_write_rx_descr(core, desc, is_last ? core->rx_pkt : NULL,
                            rss_info, do_ps ? ps_hdr_len : 0, &bastate.written);
-- 
2.7.4

From: Paolo Bonzini <pbonzini@redhat.com>

"netdev_add help" is causing QEMU to exit because the code that
invokes show_netdevs is shared between CLI and HMP processing.
Move the check to the callers so that exit(0) remains only
in the CLI flow.

"netdev_add help" is not fixed by this patch; that is left for
later work.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/net.h  |  1 +
 monitor/hmp-cmds.c |  6 +++++
 net/net.c          | 68 +++++++++++++++++++++++++++---------------------------
 3 files changed, 41 insertions(+), 34 deletions(-)

diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ extern const char *host_net_devices[];
 
 /* from net.c */
 int net_client_parse(QemuOptsList *opts_list, const char *str);
+void show_netdevs(void);
 int net_init_clients(Error **errp);
 void net_check_clients(void);
 void net_cleanup(void);
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qemu/timer.h"
 #include "qemu/sockets.h"
+#include "qemu/help_option.h"
 #include "monitor/monitor-internal.h"
 #include "qapi/error.h"
 #include "qapi/clone-visitor.h"
@@ -XXX,XX +XXX,XX @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict)
 {
     Error *err = NULL;
     QemuOpts *opts;
+    const char *type = qdict_get_try_str(qdict, "type");
 
+    if (type && is_help_option(type)) {
+        show_netdevs();
+        return;
+    }
     opts = qemu_opts_from_qdict(qemu_find_opts("netdev"), qdict, &err);
     if (err) {
         goto out;
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/config-file.h"
 #include "qemu/ctype.h"
 #include "qemu/iov.h"
+#include "qemu/qemu-print.h"
 #include "qemu/main-loop.h"
 #include "qemu/option.h"
 #include "qapi/error.h"
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
     return 0;
 }
 
-static void show_netdevs(void)
+void show_netdevs(void)
 {
     int idx;
     const char *available_netdevs[] = {
@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
 #endif
     };
 
-    printf("Available netdev backend types:\n");
+    qemu_printf("Available netdev backend types:\n");
     for (idx = 0; idx < ARRAY_SIZE(available_netdevs); idx++) {
-        puts(available_netdevs[idx]);
+        qemu_printf("%s\n", available_netdevs[idx]);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
     int ret = -1;
     Visitor *v = opts_visitor_new(opts);
 
-    const char *type = qemu_opt_get(opts, "type");
-
-    if (is_netdev && type && is_help_option(type)) {
-        show_netdevs();
-        exit(0);
-    } else {
-        /* Parse convenience option format ip6-net=fec0::0[/64] */
-        const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
+    /* Parse convenience option format ip6-net=fec0::0[/64] */
+    const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
 
-        if (ip6_net) {
-            char *prefix_addr;
-            unsigned long prefix_len = 64; /* Default 64bit prefix length. */
+    if (ip6_net) {
+        char *prefix_addr;
+        unsigned long prefix_len = 64; /* Default 64bit prefix length. */
 
-            substrings = g_strsplit(ip6_net, "/", 2);
-            if (!substrings || !substrings[0]) {
-                error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
-                           "a valid IPv6 prefix");
-                goto out;
-            }
+        substrings = g_strsplit(ip6_net, "/", 2);
+        if (!substrings || !substrings[0]) {
+            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
+                       "a valid IPv6 prefix");
+            goto out;
+        }
 
-            prefix_addr = substrings[0];
+        prefix_addr = substrings[0];
 
-            /* Handle user-specified prefix length. */
-            if (substrings[1] &&
-                qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
-            {
-                error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
-                           "ipv6-prefixlen", "a number");
-                goto out;
-            }
-
-            qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
-            qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
-                                &error_abort);
-            qemu_opt_unset(opts, "ipv6-net");
+        /* Handle user-specified prefix length. */
+        if (substrings[1] &&
+            qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
+        {
+            error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
+                       "ipv6-prefixlen", "a number");
+            goto out;
         }
+
+        qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
+        qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
+                            &error_abort);
+        qemu_opt_unset(opts, "ipv6-net");
     }
 
     /* Create an ID for -net if the user did not specify one */
@@ -XXX,XX +XXX,XX @@ static int net_init_client(void *dummy, QemuOpts *opts, Error **errp)
 
 static int net_init_netdev(void *dummy, QemuOpts *opts, Error **errp)
 {
+    const char *type = qemu_opt_get(opts, "type");
+
+    if (type && is_help_option(type)) {
+        show_netdevs();
+        exit(0);
+    }
     return net_client_init(opts, true, errp);
 }
 
-- 
2.7.4

From: Yuri Benditovich <yuri.benditovich@daynix.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1829272
When deleting queue pair, purge pending RX packets if any.
Example of problematic flow:
1. Bring up q35 VM with tap (vhost off) and virtio-net or e1000e
2. Run ping flood to the VM NIC ( 1 ms interval)
3. Hot unplug the NIC device (device_del)
   During unplug process one or more packets come, the NIC
   can't receive, tap disables read_poll
4. Hot plug the device (device_add) with the same netdev
The tap stays with read_poll disabled and does not receive
any packets anymore (tap_send never triggered)

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
 
     qemu_macaddr_set_free(&nic->conf->macaddr);
 
-    /* If this is a peer NIC and peer has already been deleted, free it now. */
-    if (nic->peer_deleted) {
-        for (i = 0; i < queues; i++) {
-            qemu_free_net_client(qemu_get_subqueue(nic, i)->peer);
+    for (i = 0; i < queues; i++) {
+        NetClientState *nc = qemu_get_subqueue(nic, i);
+        /* If this is a peer NIC and peer has already been deleted, free it now. */
+        if (nic->peer_deleted) {
+            qemu_free_net_client(nc->peer);
+        } else if (nc->peer) {
+            /* if there are RX packets pending, complete them */
+            qemu_purge_queued_packets(nc->peer);
         }
     }
 
-- 
2.7.4

From: yuanjungong <ruc_gongyuanjun@163.com>

Close fd before returning.

Buglink: https://bugs.launchpad.net/qemu/+bug/1904486

Signed-off-by: yuanjungong <ruc_gongyuanjun@163.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
         if (ret < 0) {
             error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
                              name, fd);
+            close(fd);
             return -1;
         }
 
@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
                          vhostfdname, vnet_hdr, fd, &err);
         if (err) {
             error_propagate(errp, err);
+            close(fd);
             return -1;
         }
     } else if (tap->has_fds) {
-- 
2.7.4

The following changes since commit bdee969c0e65d4d509932b1d70e3a3b2ffbff6d5:

Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-03-19 18:01:17 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to c7274b5ef43614dd133daec1e2018f71d8744088:

net/eth: Add an assert() and invert if() statement to simplify code (2021-03-22 17:34:31 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Bin Meng (4):
      net: eth: Add a helper to pad a short Ethernet frame
      net: Add a 'do_not_pad" to NetClientState
      net: Pad short frames to minimum size before sending from SLiRP/TAP
      hw/net: virtio-net: Initialize nc->do_not_pad to true

Lukas Straub (2):
      net/colo-compare.c: Fix memory leak for non-tcp packet
      net/colo-compare.c: Optimize removal of secondary packet

Philippe Mathieu-Daudé (7):
      net/eth: Use correct in6_address offset in _eth_get_rss_ex_dst_addr()
      net/eth: Simplify _eth_get_rss_ex_dst_addr()
      net/eth: Better describe _eth_get_rss_ex_dst_addr's offset argument
      net/eth: Check size earlier in _eth_get_rss_ex_dst_addr()
      net/eth: Check iovec has enough data earlier
      net/eth: Read ip6_ext_hdr_routing buffer before accessing it
      net/eth: Add an assert() and invert if() statement to simplify code

From: Bin Meng <bmeng.cn@gmail.com>

Add a helper to pad a short Ethernet frame to the minimum required
length, which can be used by backends' code.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/eth.h | 17 +++++++++++++++++
 net/eth.c         | 17 +++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/include/net/eth.h b/include/net/eth.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/eth.h
+++ b/include/net/eth.h
@@ -XXX,XX +XXX,XX @@
 
 #define ETH_ALEN 6
 #define ETH_HLEN 14
+#define ETH_ZLEN 60     /* Min. octets in frame without FCS */
 
 struct eth_header {
     uint8_t  h_dest[ETH_ALEN];   /* destination eth addr */
@@ -XXX,XX +XXX,XX @@ bool
 eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
                    size_t ip6hdr_off, eth_ip6_hdr_info *info);
 
+/**
+ * eth_pad_short_frame - pad a short frame to the minimum Ethernet frame length
+ *
+ * If the Ethernet frame size is shorter than 60 bytes, it will be padded to
+ * 60 bytes at the address @padded_pkt.
+ *
+ * @padded_pkt: buffer address to hold the padded frame
+ * @padded_buflen: pointer holding length of @padded_pkt. If the frame is
+ *                 padded, the length will be updated to the padded one.
+ * @pkt: address to hold the original Ethernet frame
+ * @pkt_size: size of the original Ethernet frame
+ * @return true if the frame is padded, otherwise false
+ */
+bool eth_pad_short_frame(uint8_t *padded_pkt, size_t *padded_buflen,
+                         const void *pkt, size_t pkt_size);
+
 #endif
diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
     info->l4proto = ext_hdr.ip6r_nxt;
     return true;
 }
+
+bool eth_pad_short_frame(uint8_t *padded_pkt, size_t *padded_buflen,
+                         const void *pkt, size_t pkt_size)
+{
+    assert(padded_buflen && *padded_buflen >= ETH_ZLEN);
+
+    if (pkt_size >= ETH_ZLEN) {
+        return false;
+    }
+
+    /* pad to minimum Ethernet frame length */
+    memcpy(padded_pkt, pkt, pkt_size);
+    memset(&padded_pkt[pkt_size], 0, ETH_ZLEN - pkt_size);
+    *padded_buflen = ETH_ZLEN;
+
+    return true;
+}
-- 
2.7.4

From: Bin Meng <bmeng.cn@gmail.com>

The minimum Ethernet frame length is 60 bytes. For short frames with
smaller length like ARP packets (only 42 bytes), on a real world NIC
it can choose either padding its length to the minimum required 60
bytes, or sending it out directly to the wire. Such behavior can be
hardcoded or controled by a register bit. Similarly on the receive
path, NICs can choose either dropping such short frames directly or
handing them over to software to handle.

On the other hand, for the network backends like SLiRP/TAP, they
don't expose a way to control the short frame behavior. As of today
they just send/receive data from/to the other end connected to them,
which means any sized packet is acceptable. So they can send and
receive short frames without any problem. It is observed that ARP
packets sent from SLiRP/TAP are 42 bytes, and SLiRP/TAP just send
these ARP packets to the other end which might be a NIC model that
does not allow short frames to pass through.

To provide better compatibility, for packets sent from QEMU network
backends like SLiRP/TAP, we change to pad short frames before sending
it out to the other end, if the other end does not forbid it via the
nc->do_not_pad flag. This ensures a backend as an Ethernet sender
does not violate the spec. But with this change, the behavior of
dropping short frames from SLiRP/TAP interfaces in the NIC model
cannot be emulated because it always receives a packet that is spec
complaint. The capability of sending short frames from NIC models is
still supported and short frames can still pass through SLiRP/TAP.

This commit should be able to fix the issue as reported with some
NIC models before, that ARP requests get dropped, preventing the
guest from becoming visible on the network. It was workarounded in
these NIC models on the receive path, that when a short frame is
received, it is padded up to 60 bytes.

The following 2 commits seem to be the one to workaround this issue
in e1000 and vmxenet3 before, and should probably be reverted.

commit 78aeb23eded2 ("e1000: Pad short frames to minimum size (60 bytes)")
  commit 40a87c6c9b11 ("vmxnet3: Pad short frames to minimum size (60 bytes)")

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/slirp.c     | 10 ++++++++++
 net/tap-win32.c | 10 ++++++++++
 net/tap.c       | 10 ++++++++++
 3 files changed, 30 insertions(+)

diff --git a/net/slirp.c b/net/slirp.c
index XXXXXXX..XXXXXXX 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -XXX,XX +XXX,XX @@
 #include <pwd.h>
 #include <sys/wait.h>
 #endif
+#include "net/eth.h"
 #include "net/net.h"
 #include "clients.h"
 #include "hub.h"
@@ -XXX,XX +XXX,XX @@ static ssize_t net_slirp_send_packet(const void *pkt, size_t pkt_len,
                                      void *opaque)
 {
     SlirpState *s = opaque;
+    uint8_t min_pkt[ETH_ZLEN];
+    size_t min_pktsz = sizeof(min_pkt);
+
+    if (!s->nc.peer->do_not_pad) {
+        if (eth_pad_short_frame(min_pkt, &min_pktsz, pkt, pkt_len)) {
+            pkt = min_pkt;
+            pkt_len = min_pktsz;
+        }
+    }
 
     return qemu_send_packet(&s->nc, pkt, pkt_len);
 }
diff --git a/net/tap-win32.c b/net/tap-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-win32.c
+++ b/net/tap-win32.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu-common.h"
 #include "clients.h"            /* net_init_tap */
+#include "net/eth.h"
 #include "net/net.h"
 #include "net/tap.h"            /* tap_has_ufo, ... */
 #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static void tap_win32_send(void *opaque)
     uint8_t *buf;
     int max_size = 4096;
     int size;
+    uint8_t min_pkt[ETH_ZLEN];
+    size_t min_pktsz = sizeof(min_pkt);
 
     size = tap_win32_read(s->handle, &buf, max_size);
     if (size > 0) {
+        if (!s->nc.peer->do_not_pad) {
+            if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
+                buf = min_pkt;
+                size = min_pktsz;
+            }
+        }
+
         qemu_send_packet(&s->nc, buf, size);
         tap_win32_free_buffer(s->handle, buf);
     }
diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@
 #include <sys/socket.h>
 #include <net/if.h>
 
+#include "net/eth.h"
 #include "net/net.h"
 #include "clients.h"
 #include "monitor/monitor.h"
@@ -XXX,XX +XXX,XX @@ static void tap_send(void *opaque)
 
     while (true) {
         uint8_t *buf = s->buf;
+        uint8_t min_pkt[ETH_ZLEN];
+        size_t min_pktsz = sizeof(min_pkt);
 
         size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
         if (size <= 0) {
@@ -XXX,XX +XXX,XX @@ static void tap_send(void *opaque)
             size -= s->host_vnet_hdr_len;
         }
 
+        if (!s->nc.peer->do_not_pad) {
+            if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
+                buf = min_pkt;
+                size = min_pktsz;
+            }
+        }
+
         size = qemu_send_packet_async(&s->nc, buf, size, tap_send_completed);
         if (size == 0) {
             tap_read_poll(s, false);
-- 
2.7.4

From: Lukas Straub <lukasstraub2@web.de>

g_queue_remove needs to look up the list entry first, but we
already have it as result and can remove it directly with
g_queue_delete_link.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
         if (result) {
             colo_release_primary_pkt(s, pkt);
             packet_destroy(result->data, NULL);
-            g_queue_remove(&conn->secondary_list, result->data);
+            g_queue_delete_link(&conn->secondary_list, result);
         } else {
             /*
              * If one packet arrive late, the secondary_list or
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The in6_address comes after the ip6_ext_hdr_routing header,
not after the ip6_ext_hdr one. Fix the offset.

Cc: qemu-stable@nongnu.org
Reported-by: Stefano Garzarella <sgarzare@redhat.com>
Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
         }
 
         bytes_read = iov_to_buf(pkt, pkt_frags,
-                                rthdr_offset + sizeof(*ext_hdr),
+                                rthdr_offset + sizeof(*rthdr),
                                 dst_addr, sizeof(*dst_addr));
 
         return bytes_read == sizeof(*dst_addr);
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The length field is already contained in the ip6_ext_hdr structure.
Check it direcly in eth_parse_ipv6_hdr() before calling
_eth_get_rss_ex_dst_addr(), which gets a bit simplified.

Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
 {
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
 
-    if ((rthdr->rtype == 2) &&
-        (rthdr->len == sizeof(struct in6_address) / 8) &&
-        (rthdr->segleft == 1)) {
+    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
 
         size_t input_size = iov_size(pkt, pkt_frags);
         size_t bytes_read;
@@ -XXX,XX +XXX,XX @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
         }
 
         if (curr_ext_hdr_type == IP6_ROUTING) {
-            info->rss_ex_dst_valid =
-                _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
-                                         ip6hdr_off + info->full_hdr_len,
-                                         &ext_hdr, &info->rss_ex_dst);
+            if (ext_hdr.ip6r_len == sizeof(struct in6_address) / 8) {
+                info->rss_ex_dst_valid =
+                    _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
+                                             ip6hdr_off + info->full_hdr_len,
+                                             &ext_hdr, &info->rss_ex_dst);
+            }
         } else if (curr_ext_hdr_type == IP6_DESTINATON) {
             info->rss_ex_src_valid =
                 _eth_get_rss_ex_src_addr(pkt, pkt_frags,
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The 'offset' argument represents the offset to the ip6_ext_hdr
header, rename it as 'ext_hdr_offset'.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ eth_is_ip6_extension_header_type(uint8_t hdr_type)
 
 static bool
 _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
-                        size_t rthdr_offset,
+                        size_t ext_hdr_offset,
                         struct ip6_ext_hdr *ext_hdr,
                         struct in6_address *dst_addr)
 {
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
         size_t input_size = iov_size(pkt, pkt_frags);
         size_t bytes_read;
 
-        if (input_size < rthdr_offset + sizeof(*ext_hdr)) {
+        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
             return false;
         }
 
         bytes_read = iov_to_buf(pkt, pkt_frags,
-                                rthdr_offset + sizeof(*rthdr),
+                                ext_hdr_offset + sizeof(*rthdr),
                                 dst_addr, sizeof(*dst_addr));
 
         return bytes_read == sizeof(*dst_addr);
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                         struct in6_address *dst_addr)
 {
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
+    size_t input_size = iov_size(pkt, pkt_frags);
+    size_t bytes_read;
 
-    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
-
-        size_t input_size = iov_size(pkt, pkt_frags);
-        size_t bytes_read;
-
-        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
-            return false;
-        }
+    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
+        return false;
+    }
 
+    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
         bytes_read = iov_to_buf(pkt, pkt_frags,
                                 ext_hdr_offset + sizeof(*rthdr),
                                 dst_addr, sizeof(*dst_addr));
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

We can't know the caller read enough data in the memory pointed
by ext_hdr to cast it as a ip6_ext_hdr_routing.
Declare rt_hdr on the stack and fill it again from the iovec.

Since we already checked there is enough data in the iovec buffer,
simply add an assert() call to consume the bytes_read variable.

This fix a 2 bytes buffer overrun in eth_parse_ipv6_hdr() reported
by QEMU fuzzer:

$ cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 \
    -accel qtest -monitor none \
    -serial none -nographic -qtest stdio
  outl 0xcf8 0x80001010
  outl 0xcfc 0xe1020000
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  write 0x25 0x1 0x86
  write 0x26 0x1 0xdd
  write 0x4f 0x1 0x2b
  write 0xe1020030 0x4 0x190002e1
  write 0xe102003a 0x2 0x0807
  write 0xe1020048 0x4 0x12077cdd
  write 0xe1020400 0x4 0xba077cdd
  write 0xe1020420 0x4 0x190002e1
  write 0xe1020428 0x4 0x3509d807
  write 0xe1020438 0x1 0xe2
  EOF
  =================================================================
  ==2859770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdef904902 at pc 0x561ceefa78de bp 0x7ffdef904820 sp 0x7ffdef904818
  READ of size 1 at 0x7ffdef904902 thread T0
      #0 0x561ceefa78dd in _eth_get_rss_ex_dst_addr net/eth.c:410:17
      #1 0x561ceefa41fb in eth_parse_ipv6_hdr net/eth.c:532:17
      #2 0x561cef7de639 in net_tx_pkt_parse_headers hw/net/net_tx_pkt.c:228:14
      #3 0x561cef7dbef4 in net_tx_pkt_parse hw/net/net_tx_pkt.c:273:9
      #4 0x561ceec29f22 in e1000e_process_tx_desc hw/net/e1000e_core.c:730:29
      #5 0x561ceec28eac in e1000e_start_xmit hw/net/e1000e_core.c:927:9
      #6 0x561ceec1baab in e1000e_set_tdt hw/net/e1000e_core.c:2444:9
      #7 0x561ceebf300e in e1000e_core_write hw/net/e1000e_core.c:3256:9
      #8 0x561cef3cd4cd in e1000e_mmio_write hw/net/e1000e.c:110:5

Address 0x7ffdef904902 is located in stack of thread T0 at offset 34 in frame
      #0 0x561ceefa320f in eth_parse_ipv6_hdr net/eth.c:486

This frame has 1 object(s):
      [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable
  HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
        (longjmp and C++ exceptions *are* supported)
  SUMMARY: AddressSanitizer: stack-buffer-overflow net/eth.c:410:17 in _eth_get_rss_ex_dst_addr
  Shadow bytes around the buggy address:
    0x10003df188d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18910: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  =>0x10003df18920:[02]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  Shadow byte legend (one shadow byte represents 8 application bytes):
    Addressable:           00
    Partially addressable: 01 02 03 04 05 06 07
    Stack left redzone:      f1
    Stack right redzone:     f3
  ==2859770==ABORTING

Add the corresponding qtest case with the fuzzer reproducer.

FWIW GCC 11 similarly reported:

net/eth.c: In function 'eth_parse_ipv6_hdr':
  net/eth.c:410:15: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |          ~~~~~^~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~
  net/eth.c:410:38: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |                                 ~~~~~^~~~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~

Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1879531
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 MAINTAINERS                    |  1 +
 net/eth.c                      | 13 +++++++----
 tests/qtest/fuzz-e1000e-test.c | 53 ++++++++++++++++++++++++++++++++++++++++++
 tests/qtest/meson.build        |  1 +
 4 files changed, 63 insertions(+), 5 deletions(-)
 create mode 100644 tests/qtest/fuzz-e1000e-test.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ e1000e
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: hw/net/e1000e*
+F: tests/qtest/fuzz-e1000e-test.c
 
 eepro100
 M: Stefan Weil <sw@weilnetz.de>
diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                         struct ip6_ext_hdr *ext_hdr,
                         struct in6_address *dst_addr)
 {
-    struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
+    struct ip6_ext_hdr_routing rt_hdr;
     size_t input_size = iov_size(pkt, pkt_frags);
     size_t bytes_read;
 
-    if (input_size < ext_hdr_offset + sizeof(*rthdr) + sizeof(*dst_addr)) {
+    if (input_size < ext_hdr_offset + sizeof(rt_hdr) + sizeof(*dst_addr)) {
         return false;
     }
 
-    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
-        bytes_read = iov_to_buf(pkt, pkt_frags,
-                                ext_hdr_offset + sizeof(*rthdr),
+    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
+                            &rt_hdr, sizeof(rt_hdr));
+    assert(bytes_read == sizeof(rt_hdr));
+
+    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
+        bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
                                 dst_addr, sizeof(*dst_addr));
 
         return bytes_read == sizeof(*dst_addr);
diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/fuzz-e1000e-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for e1000e device generated by fuzzer
+ *
+ * Copyright (c) 2021 Red Hat, Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+
+#include "libqos/libqtest.h"
+
+/*
+ * https://bugs.launchpad.net/qemu/+bug/1879531
+ */
+static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
+{
+    QTestState *s;
+
+    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
+
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xe1020000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x7);
+    qtest_writeb(s, 0x25, 0x86);
+    qtest_writeb(s, 0x26, 0xdd);
+    qtest_writeb(s, 0x4f, 0x2b);
+
+    qtest_writel(s, 0xe1020030, 0x190002e1);
+    qtest_writew(s, 0xe102003a, 0x0807);
+    qtest_writel(s, 0xe1020048, 0x12077cdd);
+    qtest_writel(s, 0xe1020400, 0xba077cdd);
+    qtest_writel(s, 0xe1020420, 0x190002e1);
+    qtest_writel(s, 0xe1020428, 0x3509d807);
+    qtest_writeb(s, 0xe1020438, 0xe2);
+    qtest_writeb(s, 0x4f, 0x2b);
+    qtest_quit(s);
+}
+
+int main(int argc, char **argv)
+{
+    const char *arch = qtest_get_arch();
+
+    g_test_init(&argc, &argv, NULL);
+
+    if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
+        qtest_add_func("fuzz/test_lp1879531_eth_get_rss_ex_dst_addr",
+                       test_lp1879531_eth_get_rss_ex_dst_addr);
+    }
+
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
   (config_all_devices.has_key('CONFIG_TPM_TIS_ISA') ? ['tpm-tis-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_TPM_TIS_ISA') ? ['tpm-tis-swtpm-test'] : []) +        \
   (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
+  (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
   qtests_pci +                                                                              \
   ['fdc-test',
    'ide-test',
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

To simplify the function body, invert the if() statement, returning
earlier.
Since we already checked there is enough data in the iovec buffer,
simply add an assert() call to consume the bytes_read variable.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
     bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
                             &rt_hdr, sizeof(rt_hdr));
     assert(bytes_read == sizeof(rt_hdr));
-
-    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
-        bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
-                                dst_addr, sizeof(*dst_addr));
-
-        return bytes_read == sizeof(*dst_addr);
+    if ((rt_hdr.rtype != 2) || (rt_hdr.segleft != 1)) {
+        return false;
     }
+    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
+                            dst_addr, sizeof(*dst_addr));
+    assert(bytes_read == sizeof(*dst_addr));
 
-    return false;
+    return true;
 }
 
 static bool
-- 
2.7.4