From nobody Thu May 2 15:28:30 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1510781852626689.1360844992056; Wed, 15 Nov 2017 13:37:32 -0800 (PST) Received: from localhost ([::1]:37935 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eF5Mx-00030k-26 for importer@patchew.org; Wed, 15 Nov 2017 16:37:15 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58924) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eF5Lt-0002Pe-Jo for qemu-devel@nongnu.org; Wed, 15 Nov 2017 16:36:10 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eF5Ls-0000pt-Lg for qemu-devel@nongnu.org; Wed, 15 Nov 2017 16:36:09 -0500 Received: from mx1.redhat.com ([209.132.183.28]:57204) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eF5Ln-0000jd-3b; Wed, 15 Nov 2017 16:36:03 -0500 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 341577EA95; Wed, 15 Nov 2017 21:36:02 +0000 (UTC) Received: from red.redhat.com (ovpn-123-34.rdu2.redhat.com [10.10.123.34]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4BC447D14B; Wed, 15 Nov 2017 21:36:01 +0000 (UTC) From: Eric Blake To: qemu-devel@nongnu.org Date: Wed, 15 Nov 2017 15:35:56 -0600 Message-Id: <20171115213557.3548-1-eblake@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Wed, 15 Nov 2017 21:36:02 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v2 for-2.11] nbd/server: Fix error reporting for bad requests X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , vsementsov@virtuozzo.com, qemu-block@nongnu.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The NBD spec says an attempt to NBD_CMD_TRIM on a read-only export should fail with EPERM, as a trim has the potential to change disk contents, but we were relying on the block layer to catch that for us, which might not always give the right error (and even if it does, it does not let us pass back a sane message for structured replies). The NBD spec says an attempt to NBD_CMD_WRITE_ZEROES out of bounds should fail with ENOSPC, not EINVAL. Our check for u64 offset + u32 length wraparound up front is pointless; nothing uses offset until after the second round of sanity checks, and we can just as easily ensure there is no wraparound by checking whether offset is in bounds (since a disk size cannot exceed off_t which is 63 bits, adding a 32-bit number for a valid offset can't overflow). Solve all of these issues by some code motion and improved request validation. Signed-off-by: Eric Blake Reviewed-by: Vladimir Sementsov-Ogievskiy --- v2: actually commit the compiler-error fixes before submitting... nbd/server.c | 36 ++++++++++++------------------------ 1 file changed, 12 insertions(+), 24 deletions(-) diff --git a/nbd/server.c b/nbd/server.c index df771fd42f..7d6801b427 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -1366,15 +1366,6 @@ static int nbd_co_receive_request(NBDRequestData *re= q, NBDRequest *request, return -EIO; } - /* Check for sanity in the parameters, part 1. Defer as many - * checks as possible until after reading any NBD_CMD_WRITE - * payload, so we can try and keep the connection alive. */ - if ((request->from + request->len) < request->from) { - error_setg(errp, - "integer overflow detected, you're probably being attac= ked"); - return -EINVAL; - } - if (request->type =3D=3D NBD_CMD_READ || request->type =3D=3D NBD_CMD_= WRITE) { if (request->len > NBD_MAX_BUFFER_SIZE) { error_setg(errp, "len (%" PRIu32" ) is larger than max len (%u= )", @@ -1399,12 +1390,21 @@ static int nbd_co_receive_request(NBDRequestData *r= eq, NBDRequest *request, request->len); } - /* Sanity checks, part 2. */ - if (request->from + request->len > client->exp->size) { + /* Sanity checks. */ + if (client->exp->nbdflags & NBD_FLAG_READ_ONLY && + (request->type =3D=3D NBD_CMD_WRITE || + request->type =3D=3D NBD_CMD_WRITE_ZEROES || + request->type =3D=3D NBD_CMD_TRIM)) { + error_setg(errp, "Export is read-only"); + return -EROFS; + } + if (request->from > client->exp->size || + request->from + request->len > client->exp->size) { error_setg(errp, "operation past EOF; From: %" PRIu64 ", Len: %" P= RIu32 ", Size: %" PRIu64, request->from, request->len, (uint64_t)client->exp->size); - return request->type =3D=3D NBD_CMD_WRITE ? -ENOSPC : -EINVAL; + return (request->type =3D=3D NBD_CMD_WRITE || + request->type =3D=3D NBD_CMD_WRITE_ZEROES) ? -ENOSPC : -EI= NVAL; } valid_flags =3D NBD_CMD_FLAG_FUA; if (request->type =3D=3D NBD_CMD_READ && client->structured_reply) { @@ -1482,12 +1482,6 @@ static coroutine_fn void nbd_trip(void *opaque) break; case NBD_CMD_WRITE: - if (exp->nbdflags & NBD_FLAG_READ_ONLY) { - error_setg(&local_err, "Export is read-only"); - ret =3D -EROFS; - break; - } - flags =3D 0; if (request.flags & NBD_CMD_FLAG_FUA) { flags |=3D BDRV_REQ_FUA; @@ -1500,12 +1494,6 @@ static coroutine_fn void nbd_trip(void *opaque) break; case NBD_CMD_WRITE_ZEROES: - if (exp->nbdflags & NBD_FLAG_READ_ONLY) { - error_setg(&local_err, "Export is read-only"); - ret =3D -EROFS; - break; - } - flags =3D 0; if (request.flags & NBD_CMD_FLAG_FUA) { flags |=3D BDRV_REQ_FUA; --=20 2.13.6