ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

qemu-nbd: more robust handling of invalid requests 

Fail invalid requests with EINVAL instead of dropping them into
the void.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Paolo Bonzini 2011-09-19 16:04:36 +02:00
parent 2204559203
commit fae6941629
1 changed files with 30 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
nbd.c
View File

@ -624,18 +624,19 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size,
if (nbd_receive_request(csock, &request) == -1) if (nbd_receive_request(csock, &request) == -1)
return -1; return -1;
reply.handle = request.handle;
reply.error = 0;
if (request.len > NBD_BUFFER_SIZE) { if (request.len > NBD_BUFFER_SIZE) {
LOG("len (%u) is larger than max len (%u)", LOG("len (%u) is larger than max len (%u)",
request.len, NBD_BUFFER_SIZE); request.len, NBD_BUFFER_SIZE);
errno = EINVAL; goto invalid_request;
return -1;
} }
if ((request.from + request.len) < request.from) { if ((request.from + request.len) < request.from) {
LOG("integer overflow detected! " LOG("integer overflow detected! "
"you're probably being attacked"); "you're probably being attacked");
errno = EINVAL; goto invalid_request;
return -1;
} }
if ((request.from + request.len) > size) { if ((request.from + request.len) > size) {
@ -643,15 +644,11 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size,
", Offset: %" PRIu64 "\n", ", Offset: %" PRIu64 "\n",
request.from, request.len, (uint64_t)size, dev_offset); request.from, request.len, (uint64_t)size, dev_offset);
LOG("requested operation past EOF--bad client?"); LOG("requested operation past EOF--bad client?");
errno = EINVAL; goto invalid_request;
return -1;
} }
TRACE("Decoding type"); TRACE("Decoding type");
reply.handle = request.handle;
reply.error = 0;
switch (request.type & NBD_CMD_MASK_COMMAND) { switch (request.type & NBD_CMD_MASK_COMMAND) {
case NBD_CMD_READ: case NBD_CMD_READ:
TRACE("Request type is READ"); TRACE("Request type is READ");
@ -661,7 +658,7 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size,
if (ret < 0) { if (ret < 0) {
LOG("reading from file failed"); LOG("reading from file failed");
reply.error = -ret; reply.error = -ret;
request.len = 0; goto error_reply;
} }
TRACE("Read %u byte(s)", request.len); TRACE("Read %u byte(s)", request.len);
@ -681,24 +678,26 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size,
if (nbdflags & NBD_FLAG_READ_ONLY) { if (nbdflags & NBD_FLAG_READ_ONLY) {
TRACE("Server is read-only, return error"); TRACE("Server is read-only, return error");
reply.error = 1; reply.error = EROFS;
} else { goto error_reply;
TRACE("Writing to device"); }
ret = bdrv_write(bs, (request.from + dev_offset) / 512, TRACE("Writing to device");
data, request.len / 512);
ret = bdrv_write(bs, (request.from + dev_offset) / 512,
data, request.len / 512);
if (ret < 0) {
LOG("writing to file failed");
reply.error = -ret;
goto error_reply;
}
if (request.type & NBD_CMD_FLAG_FUA) {
ret = bdrv_flush(bs);
if (ret < 0) { if (ret < 0) {
LOG("writing to file failed"); LOG("flush failed");
reply.error = -ret; reply.error = -ret;
request.len = 0; goto error_reply;
}
if (request.type & NBD_CMD_FLAG_FUA) {
ret = bdrv_flush(bs);
if (ret < 0) {
LOG("flush failed");
reply.error = -ret;
}
} }
} }
@ -734,8 +733,12 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size,
break; break;
default: default:
LOG("invalid request type (%u) received", request.type); LOG("invalid request type (%u) received", request.type);
errno = EINVAL; invalid_request:
return -1; reply.error = -EINVAL;
error_reply:
if (nbd_do_send_reply(csock, &reply, NULL, 0) == -1)
return -1;
break;
} }
TRACE("Request/Reply complete"); TRACE("Request/Reply complete");