From patchwork Fri Dec 23 15:26:20 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 133098 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 55815B71B0 for ; Sat, 24 Dec 2011 03:27:14 +1100 (EST) Received: from localhost ([::1]:56394 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Re73k-0003MA-UM for incoming@patchwork.ozlabs.org; Fri, 23 Dec 2011 10:29:24 -0500 Received: from eggs.gnu.org ([140.186.70.92]:51221) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Re73e-0003CB-8D for qemu-devel@nongnu.org; Fri, 23 Dec 2011 10:29:19 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Re73c-0006k5-Qz for qemu-devel@nongnu.org; Fri, 23 Dec 2011 10:29:18 -0500 Received: from mail-iy0-f173.google.com ([209.85.210.173]:37591) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Re73c-0006jy-Ma for qemu-devel@nongnu.org; Fri, 23 Dec 2011 10:29:16 -0500 Received: by iagj37 with SMTP id j37so17394063iag.4 for ; Fri, 23 Dec 2011 07:29:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=sender:from:to:subject:date:message-id:x-mailer:in-reply-to :references; bh=iNY7xugiLOD1FEFCn7zNO93hcS2WXeYwlIRYoQRbLfE=; b=F16vYcjejQnaw6WbWO3QI7Jd61h1OJ3hBmiHlZd9nqs64n3jvROHHN/DqNWy2pcWai J6vMQ66YdqmV01qpqeFOWChNLWQqxGs90GWzbeyGisV3rS2Azur5rqbhYwBsdUtsLM6q jRCYJ5hiCcOcxZGherU17AD4tLjo/QSTv/L1g= Received: by 10.50.88.129 with SMTP id bg1mr14456646igb.10.1324654156314; Fri, 23 Dec 2011 07:29:16 -0800 (PST) Received: from localhost.localdomain (93-34-178-147.ip50.fastwebnet.it. [93.34.178.147]) by mx.google.com with ESMTPS id aq5sm42055557igc.5.2011.12.23.07.29.12 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 23 Dec 2011 07:29:15 -0800 (PST) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Fri, 23 Dec 2011 16:26:20 +0100 Message-Id: <1324653990-20074-17-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 1.7.7.1 In-Reply-To: <1324653990-20074-1-git-send-email-pbonzini@redhat.com> References: <1324653990-20074-1-git-send-email-pbonzini@redhat.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 2) X-Received-From: 209.85.210.173 Subject: [Qemu-devel] [PATCH 16/26] qemu-nbd: more robust handling of invalid requests X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Fail invalid requests with EINVAL instead of dropping them into the void. Signed-off-by: Paolo Bonzini --- nbd.c | 57 ++++++++++++++++++++++++++++++--------------------------- 1 files changed, 30 insertions(+), 27 deletions(-) diff --git a/nbd.c b/nbd.c index 025c5b0..053ad8d 100644 --- a/nbd.c +++ b/nbd.c @@ -624,18 +624,19 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, if (nbd_receive_request(csock, &request) == -1) return -1; + reply.handle = request.handle; + reply.error = 0; + if (request.len > NBD_BUFFER_SIZE) { LOG("len (%u) is larger than max len (%u)", request.len, NBD_BUFFER_SIZE); - errno = EINVAL; - return -1; + goto invalid_request; } if ((request.from + request.len) < request.from) { LOG("integer overflow detected! " "you're probably being attacked"); - errno = EINVAL; - return -1; + goto invalid_request; } if ((request.from + request.len) > size) { @@ -643,15 +644,11 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, ", Offset: %" PRIu64 "\n", request.from, request.len, (uint64_t)size, dev_offset); LOG("requested operation past EOF--bad client?"); - errno = EINVAL; - return -1; + goto invalid_request; } TRACE("Decoding type"); - reply.handle = request.handle; - reply.error = 0; - switch (request.type & NBD_CMD_MASK_COMMAND) { case NBD_CMD_READ: TRACE("Request type is READ"); @@ -661,7 +658,7 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, if (ret < 0) { LOG("reading from file failed"); reply.error = -ret; - request.len = 0; + goto error_reply; } TRACE("Read %u byte(s)", request.len); @@ -681,24 +678,26 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, if (nbdflags & NBD_FLAG_READ_ONLY) { TRACE("Server is read-only, return error"); - reply.error = 1; - } else { - TRACE("Writing to device"); + reply.error = EROFS; + goto error_reply; + } + + TRACE("Writing to device"); + + ret = bdrv_write(bs, (request.from + dev_offset) / 512, + data, request.len / 512); + if (ret < 0) { + LOG("writing to file failed"); + reply.error = -ret; + goto error_reply; + } - ret = bdrv_write(bs, (request.from + dev_offset) / 512, - data, request.len / 512); + if (request.type & NBD_CMD_FLAG_FUA) { + ret = bdrv_flush(bs); if (ret < 0) { - LOG("writing to file failed"); + LOG("flush failed"); reply.error = -ret; - request.len = 0; - } - - if (request.type & NBD_CMD_FLAG_FUA) { - ret = bdrv_flush(bs); - if (ret < 0) { - LOG("flush failed"); - reply.error = -ret; - } + goto error_reply; } } @@ -734,8 +733,12 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, break; default: LOG("invalid request type (%u) received", request.type); - errno = EINVAL; - return -1; + invalid_request: + reply.error = -EINVAL; + error_reply: + if (nbd_do_send_reply(csock, &reply, NULL, 0) == -1) + return -1; + break; } TRACE("Request/Reply complete");