[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 7/8] nbd-client: Stricter enforcing of structured re
From: |
Eric Blake |
Subject: |
[Qemu-devel] [PATCH 7/8] nbd-client: Stricter enforcing of structured reply spec |
Date: |
Mon, 6 Nov 2017 21:02:35 -0600 |
Ensure that the server is not sending unexpected chunk lengths
for either the NONE or the OFFSET_DATA chunk, nor unexpected
hole length for OFFSET_HOLE. This will flag any server that
responds to a zero-length read with an OFFSET_DATA as broken, but
we just fixed things to never send that request.
Signed-off-by: Eric Blake <address@hidden>
---
block/nbd-client.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/block/nbd-client.c b/block/nbd-client.c
index d8ad2ba57c..992c6e1493 100644
--- a/block/nbd-client.c
+++ b/block/nbd-client.c
@@ -216,7 +216,7 @@ static int
nbd_parse_offset_hole_payload(NBDStructuredReplyChunk *chunk,
offset = payload_advance64(&payload);
hole_size = payload_advance32(&payload);
- if (offset < orig_offset || hole_size > qiov->size ||
+ if (!hole_size || offset < orig_offset || hole_size > qiov->size ||
offset > orig_offset + qiov->size - hole_size) {
error_setg(errp, "Protocol error: server sent chunk exceeding
requested"
" region");
@@ -281,7 +281,8 @@ static int
nbd_co_receive_offset_data_payload(NBDClientSession *s,
assert(nbd_reply_is_structured(&s->reply));
- if (chunk->length < sizeof(offset)) {
+ /* The NBD spec requires at least one byte of payload */
+ if (chunk->length <= sizeof(offset)) {
error_setg(errp, "Protocol error: invalid payload for "
"NBD_REPLY_TYPE_OFFSET_DATA");
return -EINVAL;
@@ -293,7 +294,7 @@ static int
nbd_co_receive_offset_data_payload(NBDClientSession *s,
be64_to_cpus(&offset);
data_size = chunk->length - sizeof(offset);
- if (offset < orig_offset || data_size > qiov->size ||
+ if (!data_size || offset < orig_offset || data_size > qiov->size ||
offset > orig_offset + qiov->size - data_size) {
error_setg(errp, "Protocol error: server sent chunk exceeding
requested"
" region");
@@ -411,6 +412,11 @@ static coroutine_fn int nbd_co_do_receive_one_chunk(
" NBD_REPLY_FLAG_DONE flag set");
return -EINVAL;
}
+ if (chunk->length) {
+ error_setg(errp, "Protocol error: NBD_REPLY_TYPE_NONE chunk with"
+ " nonzero length");
+ return -EINVAL;
+ }
return 0;
}
--
2.13.6
- [Qemu-devel] [PATCH 0/8] various NBD fixes for 2.11, Eric Blake, 2017/11/06
- [Qemu-devel] [PATCH 1/8] nbd-client: Fix error message typos, Eric Blake, 2017/11/06
- [Qemu-devel] [PATCH 3/8] raw: Reflect read-only protocol layer, Eric Blake, 2017/11/06
- [Qemu-devel] [PATCH 2/8] nbd/client: Nicer trace of structured reply, Eric Blake, 2017/11/06
- [Qemu-devel] [PATCH 5/8] nbd: Fix struct name for structured reads, Eric Blake, 2017/11/06
- [Qemu-devel] [PATCH 4/8] nbd-client: Honor server read-only advertisement, Eric Blake, 2017/11/06
- [Qemu-devel] [PATCH 6/8] nbd-client: Short-circuit 0-length operations, Eric Blake, 2017/11/06
- [Qemu-devel] [PATCH 8/8] nbd/server: Fix structured read of length 0, Eric Blake, 2017/11/06
- [Qemu-devel] [PATCH 7/8] nbd-client: Stricter enforcing of structured reply spec,
Eric Blake <=