From nobody Sun Apr 28 05:05:02 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1510780834617693.1643373186698; Wed, 15 Nov 2017 13:20:34 -0800 (PST) Received: from localhost ([::1]:37873 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eF56a-0005ts-Ot for importer@patchew.org; Wed, 15 Nov 2017 16:20:20 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53451) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eF55i-0005ZP-IA for qemu-devel@nongnu.org; Wed, 15 Nov 2017 16:19:27 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eF55h-00055v-Ei for qemu-devel@nongnu.org; Wed, 15 Nov 2017 16:19:26 -0500 Received: from mx1.redhat.com ([209.132.183.28]:45124) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eF55d-00050m-8J; Wed, 15 Nov 2017 16:19:21 -0500 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 533E891FCC; Wed, 15 Nov 2017 21:19:20 +0000 (UTC) Received: from red.redhat.com (ovpn-123-34.rdu2.redhat.com [10.10.123.34]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8A43690A19; Wed, 15 Nov 2017 21:19:19 +0000 (UTC) From: Eric Blake To: qemu-devel@nongnu.org Date: Wed, 15 Nov 2017 15:19:17 -0600 Message-Id: <20171115211917.789-1-eblake@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Wed, 15 Nov 2017 21:19:20 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH for-2.11] nbd/server: Fix error reporting for bad requests X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , vsementsov@virtuozzo.com, qemu-block@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The NBD spec says an attempt to NBD_CMD_TRIM on a read-only export should fail with EPERM, as a trim has the potential to change disk contents, but we were relying on the block layer to catch that for us, which might not always give the right error (and even if it does, it does not let us pass back a sane message over structured replies). The NBD spec says an attempt to NBD_CMD_WRITE_ZEROES out of bounds should fail with ENOSPC, not EINVAL. Our check for u64 offset + u32 length wraparound up front is pointless; nothing uses offset until after the second round of sanity checks, and we can just as easily ensure there is no wraparound by checking whether offset is in bounds (since a disk size cannot exceed off_t which is 63 bits, adding a 32-bit number for a valid offset can't overflow). Solve all of these issues by some code motion and improved request validation. Signed-off-by: Eric Blake --- nbd/server.c | 35 +++++++++++------------------------ 1 file changed, 11 insertions(+), 24 deletions(-) diff --git a/nbd/server.c b/nbd/server.c index df771fd42f..a27183b427 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -1366,15 +1366,6 @@ static int nbd_co_receive_request(NBDRequestData *re= q, NBDRequest *request, return -EIO; } - /* Check for sanity in the parameters, part 1. Defer as many - * checks as possible until after reading any NBD_CMD_WRITE - * payload, so we can try and keep the connection alive. */ - if ((request->from + request->len) < request->from) { - error_setg(errp, - "integer overflow detected, you're probably being attac= ked"); - return -EINVAL; - } - if (request->type =3D=3D NBD_CMD_READ || request->type =3D=3D NBD_CMD_= WRITE) { if (request->len > NBD_MAX_BUFFER_SIZE) { error_setg(errp, "len (%" PRIu32" ) is larger than max len (%u= )", @@ -1399,12 +1390,20 @@ static int nbd_co_receive_request(NBDRequestData *r= eq, NBDRequest *request, request->len); } - /* Sanity checks, part 2. */ - if (request->from + request->len > client->exp->size) { + /* Sanity checks. */ + if (client->exp->nbdflags & NBD_FLAG_READ_ONLY && + (cmd =3D=3D NBD_CMD_WRITE || cmd =3D=3D NBD_CMD_WRITE_ZEROES || + cmd =3D=3D NBD_CMD_TRIM)) { + error_setg(&local_err, "Export is read-only"); + return -EROFS; + } + if (request->from > client->exp->size || + request->from + request->len > client->exp->size) { error_setg(errp, "operation past EOF; From: %" PRIu64 ", Len: %" P= RIu32 ", Size: %" PRIu64, request->from, request->len, (uint64_t)client->exp->size); - return request->type =3D=3D NBD_CMD_WRITE ? -ENOSPC : -EINVAL; + return (request->type =3D=3D NBD_CMD_WRITE || + request->type =3D=3D NBD_CMD_WRITE_ZEROES) ? -ENOSPC : -EI= NVAL; } valid_flags =3D NBD_CMD_FLAG_FUA; if (request->type =3D=3D NBD_CMD_READ && client->structured_reply) { @@ -1482,12 +1481,6 @@ static coroutine_fn void nbd_trip(void *opaque) break; case NBD_CMD_WRITE: - if (exp->nbdflags & NBD_FLAG_READ_ONLY) { - error_setg(&local_err, "Export is read-only"); - ret =3D -EROFS; - break; - } - flags =3D 0; if (request.flags & NBD_CMD_FLAG_FUA) { flags |=3D BDRV_REQ_FUA; @@ -1500,12 +1493,6 @@ static coroutine_fn void nbd_trip(void *opaque) break; case NBD_CMD_WRITE_ZEROES: - if (exp->nbdflags & NBD_FLAG_READ_ONLY) { - error_setg(&local_err, "Export is read-only"); - ret =3D -EROFS; - break; - } - flags =3D 0; if (request.flags & NBD_CMD_FLAG_FUA) { flags |=3D BDRV_REQ_FUA; --=20 2.13.6