From nobody Wed Nov 5 13:48:13 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1498200558720404.00880101204325; Thu, 22 Jun 2017 23:49:18 -0700 (PDT) Received: from localhost ([::1]:33826 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dOIP7-0005HZ-E0 for importer@patchew.org; Fri, 23 Jun 2017 02:49:17 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47570) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dOILf-0002CM-P5 for qemu-devel@nongnu.org; Fri, 23 Jun 2017 02:45:48 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dOILb-0008AU-Ap for qemu-devel@nongnu.org; Fri, 23 Jun 2017 02:45:43 -0400 Received: from 14.mo5.mail-out.ovh.net ([188.165.51.82]:35897) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dOILb-00089f-2N for qemu-devel@nongnu.org; Fri, 23 Jun 2017 02:45:39 -0400 Received: from player695.ha.ovh.net (b9.ovh.net [213.186.33.59]) by mo5.mail-out.ovh.net (Postfix) with ESMTP id 9D0A2107B7A for ; Fri, 23 Jun 2017 08:45:37 +0200 (CEST) Received: from bahia.lan (gar31-1-82-66-74-139.fbx.proxad.net [82.66.74.139]) (Authenticated sender: groug@kaod.org) by player695.ha.ovh.net (Postfix) with ESMTPA id 6125546006E; Fri, 23 Jun 2017 08:45:34 +0200 (CEST) From: Greg Kurz To: qemu-devel@nongnu.org Date: Fri, 23 Jun 2017 08:45:34 +0200 Message-ID: <149820033413.7187.1250602964263131431.stgit@bahia.lan> In-Reply-To: <149820029273.7187.14110849422638329192.stgit@bahia.lan> References: <149820029273.7187.14110849422638329192.stgit@bahia.lan> User-Agent: StGit/0.17.1-20-gc0b1b-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Ovh-Tracer-Id: 13335439975094524337 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeeljedrleefgdduudekucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddm X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 188.165.51.82 Subject: [Qemu-devel] [PATCH v4 4/4] 9pfs: handle transport errors in pdu_complete() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Stefano Stabellini , Greg Kurz , "Michael S. Tsirkin" Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Contrary to what is written in the comment, a buggy guest can misconfigure the transport buffers and pdu_marshal() may return an error. If this ever happens, it is up to the transport layer to handle the situation (9P is transport agnostic). This fixes Coverity issue CID1348518. Signed-off-by: Greg Kurz --- hw/9pfs/9p.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 8e5cac71eb60..6c92bad5b3b4 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -624,15 +624,11 @@ void pdu_free(V9fsPDU *pdu) QLIST_INSERT_HEAD(&s->free_list, pdu, next); } =20 -/* - * We don't do error checking for pdu_marshal/unmarshal here - * because we always expect to have enough space to encode - * error details - */ static void coroutine_fn pdu_complete(V9fsPDU *pdu, ssize_t len) { int8_t id =3D pdu->id + 1; /* Response */ V9fsState *s =3D pdu->s; + int ret; =20 if (len < 0) { int err =3D -len; @@ -644,11 +640,19 @@ static void coroutine_fn pdu_complete(V9fsPDU *pdu, s= size_t len) str.data =3D strerror(err); str.size =3D strlen(str.data); =20 - len +=3D pdu_marshal(pdu, len, "s", &str); + ret =3D pdu_marshal(pdu, len, "s", &str); + if (ret < 0) { + goto out_notify; + } + len +=3D ret; id =3D P9_RERROR; } =20 - len +=3D pdu_marshal(pdu, len, "d", err); + ret =3D pdu_marshal(pdu, len, "d", err); + if (ret < 0) { + goto out_notify; + } + len +=3D ret; =20 if (s->proto_version =3D=3D V9FS_PROTO_2000L) { id =3D P9_RLERROR; @@ -657,12 +661,15 @@ static void coroutine_fn pdu_complete(V9fsPDU *pdu, s= size_t len) } =20 /* fill out the header */ - pdu_marshal(pdu, 0, "dbw", (int32_t)len, id, pdu->tag); + if (pdu_marshal(pdu, 0, "dbw", (int32_t)len, id, pdu->tag) < 0) { + goto out_notify; + } =20 /* keep these in sync */ pdu->size =3D len; pdu->id =3D id; =20 +out_notify: pdu->s->transport->push_and_notify(pdu); =20 /* Now wakeup anybody waiting in flush for this request */