From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:55002) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RXwxA-0002v1-1O for qemu-devel@nongnu.org; Tue, 06 Dec 2011 10:29:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RXwx4-0000Zu-K6 for qemu-devel@nongnu.org; Tue, 06 Dec 2011 10:29:07 -0500 Received: from mail-iy0-f173.google.com ([209.85.210.173]:40617) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RXwx4-0000A8-Fv for qemu-devel@nongnu.org; Tue, 06 Dec 2011 10:29:02 -0500 Received: by mail-iy0-f173.google.com with SMTP id j26so193361iaf.4 for ; Tue, 06 Dec 2011 07:29:02 -0800 (PST) Sender: Paolo Bonzini From: Paolo Bonzini Date: Tue, 6 Dec 2011 16:27:43 +0100 Message-Id: <1323185272-2610-17-git-send-email-pbonzini@redhat.com> In-Reply-To: <1323185272-2610-1-git-send-email-pbonzini@redhat.com> References: <1323185272-2610-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH 16/25] qemu-nbd: more robust handling of invalid requests List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Fail invalid requests with EINVAL instead of dropping them into the void. Signed-off-by: Paolo Bonzini --- nbd.c | 57 ++++++++++++++++++++++++++++++--------------------------- 1 files changed, 30 insertions(+), 27 deletions(-) diff --git a/nbd.c b/nbd.c index fb074ef..64e4ef2 100644 --- a/nbd.c +++ b/nbd.c @@ -624,18 +624,19 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, if (nbd_receive_request(csock, &request) == -1) return -1; + reply.handle = request.handle; + reply.error = 0; + if (request.len > NBD_BUFFER_SIZE) { LOG("len (%u) is larger than max len (%u)", request.len, NBD_BUFFER_SIZE); - errno = EINVAL; - return -1; + goto invalid_request; } if ((request.from + request.len) < request.from) { LOG("integer overflow detected! " "you're probably being attacked"); - errno = EINVAL; - return -1; + goto invalid_request; } if ((request.from + request.len) > size) { @@ -643,15 +644,11 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, ", Offset: %" PRIu64 "\n", request.from, request.len, (uint64_t)size, dev_offset); LOG("requested operation past EOF--bad client?"); - errno = EINVAL; - return -1; + goto invalid_request; } TRACE("Decoding type"); - reply.handle = request.handle; - reply.error = 0; - switch (request.type & NBD_CMD_MASK_COMMAND) { case NBD_CMD_READ: TRACE("Request type is READ"); @@ -661,7 +658,7 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, if (ret < 0) { LOG("reading from file failed"); reply.error = -ret; - request.len = 0; + goto error_reply; } TRACE("Read %u byte(s)", request.len); @@ -681,24 +678,26 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, if (nbdflags & NBD_FLAG_READ_ONLY) { TRACE("Server is read-only, return error"); - reply.error = 1; - } else { - TRACE("Writing to device"); + reply.error = EROFS; + goto error_reply; + } + + TRACE("Writing to device"); + + ret = bdrv_write(bs, (request.from + dev_offset) / 512, + data, request.len / 512); + if (ret < 0) { + LOG("writing to file failed"); + reply.error = -ret; + goto error_reply; + } - ret = bdrv_write(bs, (request.from + dev_offset) / 512, - data, request.len / 512); + if (request.type & NBD_CMD_FLAG_FUA) { + ret = bdrv_flush(bs); if (ret < 0) { - LOG("writing to file failed"); + LOG("flush failed"); reply.error = -ret; - request.len = 0; - } - - if (request.type & NBD_CMD_FLAG_FUA) { - ret = bdrv_flush(bs); - if (ret < 0) { - LOG("flush failed"); - reply.error = -ret; - } + goto error_reply; } } @@ -734,8 +733,12 @@ int nbd_trip(BlockDriverState *bs, int csock, off_t size, break; default: LOG("invalid request type (%u) received", request.type); - errno = EINVAL; - return -1; + invalid_request: + reply.error = -EINVAL; + error_reply: + if (nbd_do_send_reply(csock, &reply, NULL, 0) == -1) + return -1; + break; } TRACE("Request/Reply complete"); -- 1.7.7.1