@samitouri / QOSamiQemu / commits / 3609630e79

hw/net/rocker: Don't assume h_proto is aligned in eth_strip_vlan_ex()

In eth_strip_vlan_ex() we take a pointer to the eth_header h_proto field into a local uint16_t* variable, and then later in the function we dereference that pointer. This isn't safe, because the eth_header struct may not be aligned, and if we mark the struct as QEMU_PACKED then gcc will complain about taking the address of a field in a packed struct. Instead, make the local variable be a void* and use the appropriate functions for accessing 16 bits of possibly unaligned data through it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Message-ID: <20260212140917.1443253-3-peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Peter Maydell committed Feb 12, 2026 at 14:09 UTC 3609630e7910f04a007e48e4520c04fbb942658e

1 file changed +3 -3

net/eth.c

+3 -3

@@ -274,7 +274,7 @@ eth_strip_vlan_ex(const struct iovec *iov, int iovcnt, size_t iovoff, int index,

274 uint16_t *payload_offset, uint16_t *tci)

275 {

276 struct vlan_header vlan_hdr;

277 - uint16_t *new_ehdr_proto;

277 + void *new_ehdr_proto;

278 size_t new_ehdr_size;

279 size_t copied;

280

@@ -298,7 +298,7 @@ eth_strip_vlan_ex(const struct iovec *iov, int iovcnt, size_t iovoff, int index,

298 return 0;

299 }

300

301 - if (copied < new_ehdr_size || be16_to_cpu(*new_ehdr_proto) != vet) {

301 + if (copied < new_ehdr_size || lduw_be_p(new_ehdr_proto) != vet) {

302 return 0;

303 }

304

@@ -308,7 +308,7 @@ eth_strip_vlan_ex(const struct iovec *iov, int iovcnt, size_t iovoff, int index,

308 return 0;

309 }

310

311 - *new_ehdr_proto = vlan_hdr.h_proto;

311 + stw_he_p(new_ehdr_proto, vlan_hdr.h_proto);

312 *payload_offset = iovoff + new_ehdr_size + sizeof(vlan_hdr);

313 *tci = be16_to_cpu(vlan_hdr.h_tci);

314