diff mbox

[1/2] nbd: do not check request length except for reads and writes

Message ID 1452174266-11594-2-git-send-email-pbonzini@redhat.com
State New
Headers show

Commit Message

Paolo Bonzini Jan. 7, 2016, 1:44 p.m. UTC 
Only reads and writes need to allocate memory correspondent to the
request length.  Other requests can be sent to the storage without
allocating any memory, and thus any request length is acceptable.

Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com>
Cc: qemu-block@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 nbd.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

Comments

Max Reitz Jan. 7, 2016, 9:17 p.m. UTC | #1 
On 07.01.2016 14:44, Paolo Bonzini wrote:
> Only reads and writes need to allocate memory correspondent to the
> request length.  Other requests can be sent to the storage without
> allocating any memory, and thus any request length is acceptable.
> 
> Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com>
> Cc: qemu-block@nongnu.org
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  nbd.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)

Reviewed-by: Max Reitz <mreitz@redhat.com>
diff mbox

Patch

diff --git a/nbd.c b/nbd.c
index b3d9654..e395a16 100644
--- a/nbd.c
+++ b/nbd.c
@@ -1227,13 +1227,6 @@  static ssize_t nbd_co_receive_request(NBDRequest *req, struct nbd_request *reque
         goto out;
     }
 
-    if (request->len > NBD_MAX_BUFFER_SIZE) {
-        LOG("len (%u) is larger than max len (%u)",
-            request->len, NBD_MAX_BUFFER_SIZE);
-        rc = -EINVAL;
-        goto out;
-    }
-
     if ((request->from + request->len) < request->from) {
         LOG("integer overflow detected! "
             "you're probably being attacked");
@@ -1245,6 +1238,13 @@  static ssize_t nbd_co_receive_request(NBDRequest *req, struct nbd_request *reque
 
     command = request->type & NBD_CMD_MASK_COMMAND;
     if (command == NBD_CMD_READ || command == NBD_CMD_WRITE) {
+        if (request->len > NBD_MAX_BUFFER_SIZE) {
+            LOG("len (%u) is larger than max len (%u)",
+                request->len, NBD_MAX_BUFFER_SIZE);
+            rc = -EINVAL;
+            goto out;
+        }
+
         req->data = blk_blockalign(client->exp->blk, request->len);
     }
     if (command == NBD_CMD_WRITE) {