From nobody Fri May 3 11:16:39 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1578339533; cv=none; d=zohomail.com; s=zohoarc; b=PXIZ2L2tuTvx+2ugZbzSvTy0o8SWPwyD1LsIBJ1NDg9vdbLDQrHaSKOn9L6f/6B3WGb1JGJPAlBeKj2BHxou1qsFih0FwU0+6zGv6ykWCRBWpz/sf9nwgk4zLXOhUBZd3Qc5uBioLWl0zG68Mjp7tVMhy6GvakLbhWDD6vojZio= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1578339533; h=Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:Message-ID:Sender:Subject:To; bh=nAhVlHJk/ivkMyvtq1ZgKgpyEXjC+9L7O65z+QLNzNk=; b=UN2YM2Uer7xNDLadk730ob7bE0NGz89B/WwfByOPf6rsWbFCDoeHRpRaWQLxTD4nteuOu5Uzo7NcpyQoZVYQkkEApyxHgyV3amYyiUYXdJ4hHVgdXWoKD8uW9KUojJBCOZ4sU6I+Lg9bUG5Xojp+dWlDzZX3Nfj4CjeOSBt1KEo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 157833953374685.74251138866259; Mon, 6 Jan 2020 11:38:53 -0800 (PST) Received: from localhost ([::1]:59152 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ioYDE-000442-0x for importer@patchew.org; Mon, 06 Jan 2020 14:38:52 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:49901) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1ioYCb-0003dH-Vp for qemu-devel@nongnu.org; Mon, 06 Jan 2020 14:38:15 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ioYCa-0003GG-Ca for qemu-devel@nongnu.org; Mon, 06 Jan 2020 14:38:13 -0500 Received: from mail.kernel.org ([198.145.29.99]:47002) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ioYCa-0003El-4R for qemu-devel@nongnu.org; Mon, 06 Jan 2020 14:38:12 -0500 Received: from sstabellini-ThinkPad-T480s.xilinx.com (c-67-164-102-47.hsd1.ca.comcast.net [67.164.102.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 863EB2072C; Mon, 6 Jan 2020 19:38:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578339490; bh=e/fGBJCpaBGe2knrhtpfaipnOSccMjzCmv1uSKbAF48=; h=From:To:Cc:Subject:Date:From; b=r7JXLqZxxva5TG/fe5+bhnjrSinRtaKqwWYPyJp4AFhdHI+xf8vEm+i6s4jOQPso/ LI9/KpmIjI2GCDr1bHeGdYKl/ekS4a0RU3Ks+lq+twC6MwCcB06yBygpSAiwWfikFz H3PVz7SBz88KGN2N2z8cRIGH/82ohPr8w4NPhmGk= From: Stefano Stabellini To: qemu-devel@nongnu.org Subject: [PATCH v2] 9p: init_in_iov_from_pdu can truncate the size Date: Mon, 6 Jan 2020 11:38:09 -0800 Message-Id: <20200106193809.23144-1-sstabellini@kernel.org> X-Mailer: git-send-email 2.17.1 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 198.145.29.99 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: sstabellini@kernel.org, roman@zededa.com, qemu_oss@crudebyte.com, groug@kaod.org, anthony.perard@citrix.com, Stefano Stabellini Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Stefano Stabellini init_in_iov_from_pdu might not be able to allocate the full buffer size requested, which comes from the client and could be larger than the transport has available at the time of the request. Specifically, this can happen with read operations, with the client requesting a read up to the max allowed, which might be more than the transport has available at the time. Today the implementation of init_in_iov_from_pdu throws an error, both Xen and Virtio. Instead, change the V9fsTransport interface so that the size becomes a pointer and can be limited by the implementation of init_in_iov_from_pdu. Change both the Xen and Virtio implementations to set the size to the size of the buffer they managed to allocate, instead of throwing an error. However, if the allocated buffer size is less than P9_IOHDRSZ (the size of the header) still throw an error as the case is unhandable. Signed-off-by: Stefano Stabellini CC: groug@kaod.org CC: anthony.perard@citrix.com CC: roman@zededa.com CC: qemu_oss@crudebyte.com --- Changes in v2: - rebase to master - fix code style - fix build issue passing pointers of different size - retain transport error if allocated size is less than P9_IOHDRSZ --- hw/9pfs/9p.c | 26 +++++++++++++++++++------- hw/9pfs/9p.h | 2 +- hw/9pfs/virtio-9p-device.c | 11 +++++++---- hw/9pfs/xen-9p-backend.c | 13 ++++++++----- 4 files changed, 35 insertions(+), 17 deletions(-) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 520177f40c..2efed37753 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -2090,22 +2090,29 @@ out_nofid: * with qemu_iovec_destroy(). */ static void v9fs_init_qiov_from_pdu(QEMUIOVector *qiov, V9fsPDU *pdu, - size_t skip, size_t size, + size_t skip, size_t *size, bool is_write) { QEMUIOVector elem; struct iovec *iov; unsigned int niov; + size_t alloc_size =3D *size + skip; =20 if (is_write) { - pdu->s->transport->init_out_iov_from_pdu(pdu, &iov, &niov, size + = skip); + pdu->s->transport->init_out_iov_from_pdu(pdu, &iov, &niov, alloc_s= ize); } else { - pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size + s= kip); + pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, &alloc_s= ize); + } + + if (alloc_size < skip) { + *size =3D 0; + } else { + *size =3D alloc_size - skip; } =20 qemu_iovec_init_external(&elem, iov, niov); qemu_iovec_init(qiov, niov); - qemu_iovec_concat(qiov, &elem, skip, size); + qemu_iovec_concat(qiov, &elem, skip, *size); } =20 static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp, @@ -2130,7 +2137,7 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu= , V9fsFidState *fidp, } offset +=3D err; =20 - v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset, read_count, false); + v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset, &read_count, false); err =3D v9fs_pack(qiov_full.iov, qiov_full.niov, 0, ((char *)fidp->fs.xattr.value) + off, read_count); @@ -2259,9 +2266,11 @@ static void coroutine_fn v9fs_read(void *opaque) QEMUIOVector qiov_full; QEMUIOVector qiov; int32_t len; + size_t size =3D max_count; =20 - v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset + 4, max_count, fa= lse); + v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset + 4, &size, false); qemu_iovec_init(&qiov, qiov_full.niov); + max_count =3D size; do { qemu_iovec_reset(&qiov); qemu_iovec_concat(&qiov, &qiov_full, count, qiov_full.size - c= ount); @@ -2504,6 +2513,7 @@ static void coroutine_fn v9fs_write(void *opaque) int32_t len =3D 0; int32_t total =3D 0; size_t offset =3D 7; + size_t size; V9fsFidState *fidp; V9fsPDU *pdu =3D opaque; V9fsState *s =3D pdu->s; @@ -2516,7 +2526,9 @@ static void coroutine_fn v9fs_write(void *opaque) return; } offset +=3D err; - v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset, count, true); + size =3D count; + v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset, &size, true); + count =3D size; trace_v9fs_write(pdu->tag, pdu->id, fid, off, count, qiov_full.niov); =20 fidp =3D get_fid(pdu, fid); diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h index 3904f82901..8d07a0b301 100644 --- a/hw/9pfs/9p.h +++ b/hw/9pfs/9p.h @@ -425,7 +425,7 @@ struct V9fsTransport { ssize_t (*pdu_vunmarshal)(V9fsPDU *pdu, size_t offset, const char = *fmt, va_list ap); void (*init_in_iov_from_pdu)(V9fsPDU *pdu, struct iovec **piov, - unsigned int *pniov, size_t size); + unsigned int *pniov, size_t *size); void (*init_out_iov_from_pdu)(V9fsPDU *pdu, struct iovec **piov, unsigned int *pniov, size_t size); void (*push_and_notify)(V9fsPDU *pdu); diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c index b5a7c03f26..991e175c82 100644 --- a/hw/9pfs/virtio-9p-device.c +++ b/hw/9pfs/virtio-9p-device.c @@ -147,19 +147,22 @@ static ssize_t virtio_pdu_vunmarshal(V9fsPDU *pdu, si= ze_t offset, } =20 static void virtio_init_in_iov_from_pdu(V9fsPDU *pdu, struct iovec **piov, - unsigned int *pniov, size_t size) + unsigned int *pniov, size_t *size) { V9fsState *s =3D pdu->s; V9fsVirtioState *v =3D container_of(s, V9fsVirtioState, state); VirtQueueElement *elem =3D v->elems[pdu->idx]; size_t buf_size =3D iov_size(elem->in_sg, elem->in_num); =20 - if (buf_size < size) { + if (buf_size < P9_IOHDRSZ) { VirtIODevice *vdev =3D VIRTIO_DEVICE(v); =20 virtio_error(vdev, - "VirtFS reply type %d needs %zu bytes, buffer has %zu= ", - pdu->id + 1, size, buf_size); + "VirtFS reply type %d needs %zu bytes, buffer has %zu= , less than minimum", + pdu->id + 1, *size, buf_size); + } + if (buf_size < *size) { + *size =3D buf_size; } =20 *piov =3D elem->in_sg; diff --git a/hw/9pfs/xen-9p-backend.c b/hw/9pfs/xen-9p-backend.c index 71eebe12dd..18fe5b7c92 100644 --- a/hw/9pfs/xen-9p-backend.c +++ b/hw/9pfs/xen-9p-backend.c @@ -187,7 +187,7 @@ static void xen_9pfs_init_out_iov_from_pdu(V9fsPDU *pdu, static void xen_9pfs_init_in_iov_from_pdu(V9fsPDU *pdu, struct iovec **piov, unsigned int *pniov, - size_t size) + size_t *size) { Xen9pfsDev *xen_9pfs =3D container_of(pdu->s, Xen9pfsDev, state); Xen9pfsRing *ring =3D &xen_9pfs->rings[pdu->tag % xen_9pfs->num_rings]; @@ -197,16 +197,19 @@ static void xen_9pfs_init_in_iov_from_pdu(V9fsPDU *pd= u, g_free(ring->sg); =20 ring->sg =3D g_new0(struct iovec, 2); - xen_9pfs_in_sg(ring, ring->sg, &num, pdu->idx, size); + xen_9pfs_in_sg(ring, ring->sg, &num, pdu->idx, *size); =20 buf_size =3D iov_size(ring->sg, num); - if (buf_size < size) { + if (buf_size < P9_IOHDRSZ) { xen_pv_printf(&xen_9pfs->xendev, 0, "Xen 9pfs request type %d" - "needs %zu bytes, buffer has %zu\n", pdu->id, size, - buf_size); + "needs %zu bytes, buffer has %zu, less than minimum\n", + pdu->id, *size, buf_size); xen_be_set_state(&xen_9pfs->xendev, XenbusStateClosing); xen_9pfs_disconnect(&xen_9pfs->xendev); } + if (buf_size < *size) { + *size =3D buf_size; + } =20 *piov =3D ring->sg; *pniov =3D num; --=20 2.17.1