diff mbox

[2/2] nbd: Don't validate from and len in NBD_CMD_DISC.

Message ID 1400410205-26152-2-git-send-email-kroosec@gmail.com
State New
Headers show

Commit Message

Hani Benhabiles May 18, 2014, 10:50 a.m. UTC
These values aren't used in this case.

Currently, the from field in the request sent by the nbd kernel module leading
to a false error message when ending the connection with the client.

$ qemu-nbd some.img -v
// After nbd-client -d /dev/nbd0
nbd.c:nbd_trip():L1031: From: 18446744073709551104, Len: 0, Size: 20971520,
Offset: 0
nbd.c:nbd_trip():L1032: requested operation past EOF--bad client?
nbd.c:nbd_receive_request():L638: read failed

Signed-off-by: Hani Benhabiles <hani@linux.com>
---
 nbd.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Comments

Paolo Bonzini May 19, 2014, 11:05 a.m. UTC | #1
Il 18/05/2014 12:50, Hani Benhabiles ha scritto:
> These values aren't used in this case.
>
> Currently, the from field in the request sent by the nbd kernel module leading
> to a false error message when ending the connection with the client.
>
> $ qemu-nbd some.img -v
> // After nbd-client -d /dev/nbd0
> nbd.c:nbd_trip():L1031: From: 18446744073709551104, Len: 0, Size: 20971520,
> Offset: 0
> nbd.c:nbd_trip():L1032: requested operation past EOF--bad client?
> nbd.c:nbd_receive_request():L638: read failed
>
> Signed-off-by: Hani Benhabiles <hani@linux.com>
> ---
>  nbd.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/nbd.c b/nbd.c
> index e5084b6..dc076d7 100644
> --- a/nbd.c
> +++ b/nbd.c
> @@ -1001,6 +1001,7 @@ static void nbd_trip(void *opaque)
>      struct nbd_request request;
>      struct nbd_reply reply;
>      ssize_t ret;
> +    uint32_t type;
>
>      TRACE("Reading request.");
>      if (client->closing) {
> @@ -1023,8 +1024,8 @@ static void nbd_trip(void *opaque)
>          reply.error = -ret;
>          goto error_reply;
>      }
> -
> -    if ((request.from + request.len) > exp->size) {
> +    type = request.type & NBD_CMD_MASK_COMMAND;
> +    if (type != NBD_CMD_DISC && (request.from + request.len) > exp->size) {
>              LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
>              ", Offset: %" PRIu64 "\n",
>                      request.from, request.len,
> @@ -1033,7 +1034,7 @@ static void nbd_trip(void *opaque)
>          goto invalid_request;
>      }
>
> -    switch (request.type & NBD_CMD_MASK_COMMAND) {
> +    switch (type) {
>      case NBD_CMD_READ:
>          TRACE("Request type is READ");
>
>

Applied after renaming the variable from type to command (for 
consistency with e.g. nbd_co_receive_request).

Paolo
Hani Benhabiles May 19, 2014, 9:22 p.m. UTC | #2
On Mon, May 19, 2014 at 01:05:12PM +0200, Paolo Bonzini wrote:
> Il 18/05/2014 12:50, Hani Benhabiles ha scritto:
> >These values aren't used in this case.
> >
> >Currently, the from field in the request sent by the nbd kernel module leading
> >to a false error message when ending the connection with the client.
> >
> >$ qemu-nbd some.img -v
> >// After nbd-client -d /dev/nbd0
> >nbd.c:nbd_trip():L1031: From: 18446744073709551104, Len: 0, Size: 20971520,
> >Offset: 0
> >nbd.c:nbd_trip():L1032: requested operation past EOF--bad client?
> >nbd.c:nbd_receive_request():L638: read failed
> >
> >Signed-off-by: Hani Benhabiles <hani@linux.com>
> >---
> > nbd.c | 7 ++++---
> > 1 file changed, 4 insertions(+), 3 deletions(-)
> >
> >diff --git a/nbd.c b/nbd.c
> >index e5084b6..dc076d7 100644
> >--- a/nbd.c
> >+++ b/nbd.c
> >@@ -1001,6 +1001,7 @@ static void nbd_trip(void *opaque)
> >     struct nbd_request request;
> >     struct nbd_reply reply;
> >     ssize_t ret;
> >+    uint32_t type;
> >
> >     TRACE("Reading request.");
> >     if (client->closing) {
> >@@ -1023,8 +1024,8 @@ static void nbd_trip(void *opaque)
> >         reply.error = -ret;
> >         goto error_reply;
> >     }
> >-
> >-    if ((request.from + request.len) > exp->size) {
> >+    type = request.type & NBD_CMD_MASK_COMMAND;
> >+    if (type != NBD_CMD_DISC && (request.from + request.len) > exp->size) {
> >             LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
> >             ", Offset: %" PRIu64 "\n",
> >                     request.from, request.len,
> >@@ -1033,7 +1034,7 @@ static void nbd_trip(void *opaque)
> >         goto invalid_request;
> >     }
> >
> >-    switch (request.type & NBD_CMD_MASK_COMMAND) {
> >+    switch (type) {
> >     case NBD_CMD_READ:
> >         TRACE("Request type is READ");
> >
> >
> 
> Applied after renaming the variable from type to command (for consistency
> with e.g. nbd_co_receive_request).

No issue. Thanks!
diff mbox

Patch

diff --git a/nbd.c b/nbd.c
index e5084b6..dc076d7 100644
--- a/nbd.c
+++ b/nbd.c
@@ -1001,6 +1001,7 @@  static void nbd_trip(void *opaque)
     struct nbd_request request;
     struct nbd_reply reply;
     ssize_t ret;
+    uint32_t type;
 
     TRACE("Reading request.");
     if (client->closing) {
@@ -1023,8 +1024,8 @@  static void nbd_trip(void *opaque)
         reply.error = -ret;
         goto error_reply;
     }
-
-    if ((request.from + request.len) > exp->size) {
+    type = request.type & NBD_CMD_MASK_COMMAND;
+    if (type != NBD_CMD_DISC && (request.from + request.len) > exp->size) {
             LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64
             ", Offset: %" PRIu64 "\n",
                     request.from, request.len,
@@ -1033,7 +1034,7 @@  static void nbd_trip(void *opaque)
         goto invalid_request;
     }
 
-    switch (request.type & NBD_CMD_MASK_COMMAND) {
+    switch (type) {
     case NBD_CMD_READ:
         TRACE("Request type is READ");