Commit 085ee6d2 authored by Peter Maydell's avatar Peter Maydell
Browse files

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-11-17' into staging 



nbd patches for 2017-11-17

Eric Blake - nbd: Don't crash when server reports NBD_CMD_READ failure
Eric Blake - nbd/client: Use error_prepend() correctly
Eric Blake - nbd/client: Don't hard-disconnect on ESHUTDOWN from server
Eric Blake - nbd/server: Fix error reporting for bad requests

# gpg: Signature made Fri 17 Nov 2017 14:53:30 GMT
# gpg:                using RSA key 0xA7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>"
# gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
# gpg:                 aka "[jpeg image of size 6874]"
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2  F3AA A7A1 6B4A 2527 436A

* remotes/ericb/tags/pull-nbd-2017-11-17:
  nbd/server: Fix error reporting for bad requests
  nbd/client: Don't hard-disconnect on ESHUTDOWN from server
  nbd/client: Use error_prepend() correctly
  nbd: Don't crash when server reports NBD_CMD_READ failure

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parents fec035a5 fed5f8f8

block/nbd-client.c

+2 −2
Original line number Diff line number Diff line
@@ -78,7 +78,7 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque) 
    while (!s->quit) {

        assert(s->reply.handle == 0);

        ret = nbd_receive_reply(s->ioc, &s->reply, &local_err);

        if (ret < 0) {

        if (local_err) {

            error_report_err(local_err);

        }

        if (ret <= 0) {
@@ -691,7 +691,7 @@ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset, 


    ret = nbd_co_receive_cmdread_reply(client, request.handle, offset, qiov,

                                       &local_err);

    if (ret < 0) {

    if (local_err) {

        error_report_err(local_err);

    }

    return ret;

nbd/client.c

+26 −30
Original line number Diff line number Diff line
@@ -79,12 +79,12 @@ static int nbd_send_option_request(QIOChannel *ioc, uint32_t opt, 
    stl_be_p(&req.length, len);



    if (nbd_write(ioc, &req, sizeof(req), errp) < 0) {

        error_prepend(errp, "Failed to send option request header");

        error_prepend(errp, "Failed to send option request header: ");

        return -1;

    }



    if (len && nbd_write(ioc, (char *) data, len, errp) < 0) {

        error_prepend(errp, "Failed to send option request data");

        error_prepend(errp, "Failed to send option request data: ");

        return -1;

    }
@@ -113,7 +113,7 @@ static int nbd_receive_option_reply(QIOChannel *ioc, uint32_t opt, 
{

    QEMU_BUILD_BUG_ON(sizeof(*reply) != 20);

    if (nbd_read(ioc, reply, sizeof(*reply), errp) < 0) {

        error_prepend(errp, "failed to read option reply");

        error_prepend(errp, "failed to read option reply: ");

        nbd_send_opt_abort(ioc);

        return -1;

    }
@@ -166,7 +166,7 @@ static int nbd_handle_reply_err(QIOChannel *ioc, nbd_opt_reply *reply, 
        msg = g_malloc(reply->length + 1);

        if (nbd_read(ioc, msg, reply->length, errp) < 0) {

            error_prepend(errp, "failed to read option error 0x%" PRIx32

                          " (%s) message",

                          " (%s) message: ",

                          reply->type, nbd_rep_lookup(reply->type));

            goto cleanup;

        }
@@ -277,7 +277,7 @@ static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match, 
        return -1;

    }

    if (nbd_read(ioc, &namelen, sizeof(namelen), errp) < 0) {

        error_prepend(errp, "failed to read option name length");

        error_prepend(errp, "failed to read option name length: ");

        nbd_send_opt_abort(ioc);

        return -1;

    }
@@ -290,7 +290,8 @@ static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match, 
    }

    if (namelen != strlen(want)) {

        if (nbd_drop(ioc, len, errp) < 0) {

            error_prepend(errp, "failed to skip export name with wrong length");

            error_prepend(errp,

                          "failed to skip export name with wrong length: ");

            nbd_send_opt_abort(ioc);

            return -1;

        }
@@ -299,14 +300,14 @@ static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match, 


    assert(namelen < sizeof(name));

    if (nbd_read(ioc, name, namelen, errp) < 0) {

        error_prepend(errp, "failed to read export name");

        error_prepend(errp, "failed to read export name: ");

        nbd_send_opt_abort(ioc);

        return -1;

    }

    name[namelen] = '\0';

    len -= namelen;

    if (nbd_drop(ioc, len, errp) < 0) {

        error_prepend(errp, "failed to read export description");

        error_prepend(errp, "failed to read export description: ");

        nbd_send_opt_abort(ioc);

        return -1;

    }
@@ -390,7 +391,7 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname, 
            return -1;

        }

        if (nbd_read(ioc, &type, sizeof(type), errp) < 0) {

            error_prepend(errp, "failed to read info type");

            error_prepend(errp, "failed to read info type: ");

            nbd_send_opt_abort(ioc);

            return -1;

        }
@@ -405,13 +406,13 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname, 
                return -1;

            }

            if (nbd_read(ioc, &info->size, sizeof(info->size), errp) < 0) {

                error_prepend(errp, "failed to read info size");

                error_prepend(errp, "failed to read info size: ");

                nbd_send_opt_abort(ioc);

                return -1;

            }

            be64_to_cpus(&info->size);

            if (nbd_read(ioc, &info->flags, sizeof(info->flags), errp) < 0) {

                error_prepend(errp, "failed to read info flags");

                error_prepend(errp, "failed to read info flags: ");

                nbd_send_opt_abort(ioc);

                return -1;

            }
@@ -428,7 +429,7 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname, 
            }

            if (nbd_read(ioc, &info->min_block, sizeof(info->min_block),

                         errp) < 0) {

                error_prepend(errp, "failed to read info minimum block size");

                error_prepend(errp, "failed to read info minimum block size: ");

                nbd_send_opt_abort(ioc);

                return -1;

            }
@@ -441,7 +442,8 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname, 
            }

            if (nbd_read(ioc, &info->opt_block, sizeof(info->opt_block),

                         errp) < 0) {

                error_prepend(errp, "failed to read info preferred block size");

                error_prepend(errp,

                              "failed to read info preferred block size: ");

                nbd_send_opt_abort(ioc);

                return -1;

            }
@@ -455,7 +457,7 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname, 
            }

            if (nbd_read(ioc, &info->max_block, sizeof(info->max_block),

                         errp) < 0) {

                error_prepend(errp, "failed to read info maximum block size");

                error_prepend(errp, "failed to read info maximum block size: ");

                nbd_send_opt_abort(ioc);

                return -1;

            }
@@ -467,7 +469,7 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname, 
        default:

            trace_nbd_opt_go_info_unknown(type, nbd_info_lookup(type));

            if (nbd_drop(ioc, len, errp) < 0) {

                error_prepend(errp, "Failed to read info payload");

                error_prepend(errp, "Failed to read info payload: ");

                nbd_send_opt_abort(ioc);

                return -1;

            }
@@ -618,7 +620,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, 
    }



    if (nbd_read(ioc, buf, 8, errp) < 0) {

        error_prepend(errp, "Failed to read data");

        error_prepend(errp, "Failed to read data: ");

        goto fail;

    }
@@ -637,7 +639,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, 
    }



    if (nbd_read(ioc, &magic, sizeof(magic), errp) < 0) {

        error_prepend(errp, "Failed to read magic");

        error_prepend(errp, "Failed to read magic: ");

        goto fail;

    }

    magic = be64_to_cpu(magic);
@@ -649,7 +651,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, 
        bool fixedNewStyle = false;



        if (nbd_read(ioc, &globalflags, sizeof(globalflags), errp) < 0) {

            error_prepend(errp, "Failed to read server flags");

            error_prepend(errp, "Failed to read server flags: ");

            goto fail;

        }

        globalflags = be16_to_cpu(globalflags);
@@ -665,7 +667,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, 
        /* client requested flags */

        clientflags = cpu_to_be32(clientflags);

        if (nbd_write(ioc, &clientflags, sizeof(clientflags), errp) < 0) {

            error_prepend(errp, "Failed to send clientflags field");

            error_prepend(errp, "Failed to send clientflags field: ");

            goto fail;

        }

        if (tlscreds) {
@@ -727,13 +729,13 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, 


        /* Read the response */

        if (nbd_read(ioc, &info->size, sizeof(info->size), errp) < 0) {

            error_prepend(errp, "Failed to read export length");

            error_prepend(errp, "Failed to read export length: ");

            goto fail;

        }

        be64_to_cpus(&info->size);



        if (nbd_read(ioc, &info->flags, sizeof(info->flags), errp) < 0) {

            error_prepend(errp, "Failed to read export flags");

            error_prepend(errp, "Failed to read export flags: ");

            goto fail;

        }

        be16_to_cpus(&info->flags);
@@ -750,13 +752,13 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, 
        }



        if (nbd_read(ioc, &info->size, sizeof(info->size), errp) < 0) {

            error_prepend(errp, "Failed to read export length");

            error_prepend(errp, "Failed to read export length: ");

            goto fail;

        }

        be64_to_cpus(&info->size);



        if (nbd_read(ioc, &oldflags, sizeof(oldflags), errp) < 0) {

            error_prepend(errp, "Failed to read export flags");

            error_prepend(errp, "Failed to read export flags: ");

            goto fail;

        }

        be32_to_cpus(&oldflags);
@@ -772,7 +774,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, 


    trace_nbd_receive_negotiate_size_flags(info->size, info->flags);

    if (zeroes && nbd_drop(ioc, 124, errp) < 0) {

        error_prepend(errp, "Failed to read reserved block");

        error_prepend(errp, "Failed to read reserved block: ");

        goto fail;

    }

    rc = 0;
@@ -994,15 +996,9 @@ int nbd_receive_reply(QIOChannel *ioc, NBDReply *reply, Error **errp) 
        if (ret < 0) {

            break;

        }



        trace_nbd_receive_simple_reply(reply->simple.error,

                                       nbd_err_lookup(reply->simple.error),

                                       reply->handle);

        if (reply->simple.error == NBD_ESHUTDOWN) {

            /* This works even on mingw which lacks a native ESHUTDOWN */

            error_setg(errp, "server shutting down");

            return -EINVAL;

        }

        break;

    case NBD_STRUCTURED_REPLY_MAGIC:

        ret = nbd_receive_structured_reply_chunk(ioc, &reply->structured, errp);

nbd/server.c

+12 −24
Original line number Diff line number Diff line
@@ -1366,15 +1366,6 @@ static int nbd_co_receive_request(NBDRequestData *req, NBDRequest *request, 
        return -EIO;

    }



    /* Check for sanity in the parameters, part 1.  Defer as many

     * checks as possible until after reading any NBD_CMD_WRITE

     * payload, so we can try and keep the connection alive.  */

    if ((request->from + request->len) < request->from) {

        error_setg(errp,

                   "integer overflow detected, you're probably being attacked");

        return -EINVAL;

    }



    if (request->type == NBD_CMD_READ || request->type == NBD_CMD_WRITE) {

        if (request->len > NBD_MAX_BUFFER_SIZE) {

            error_setg(errp, "len (%" PRIu32" ) is larger than max len (%u)",
@@ -1399,12 +1390,21 @@ static int nbd_co_receive_request(NBDRequestData *req, NBDRequest *request, 
                                                      request->len);

    }



    /* Sanity checks, part 2. */

    if (request->from + request->len > client->exp->size) {

    /* Sanity checks. */

    if (client->exp->nbdflags & NBD_FLAG_READ_ONLY &&

        (request->type == NBD_CMD_WRITE ||

         request->type == NBD_CMD_WRITE_ZEROES ||

         request->type == NBD_CMD_TRIM)) {

        error_setg(errp, "Export is read-only");

        return -EROFS;

    }

    if (request->from > client->exp->size ||

        request->from + request->len > client->exp->size) {

        error_setg(errp, "operation past EOF; From: %" PRIu64 ", Len: %" PRIu32

                   ", Size: %" PRIu64, request->from, request->len,

                   (uint64_t)client->exp->size);

        return request->type == NBD_CMD_WRITE ? -ENOSPC : -EINVAL;

        return (request->type == NBD_CMD_WRITE ||

                request->type == NBD_CMD_WRITE_ZEROES) ? -ENOSPC : -EINVAL;

    }

    valid_flags = NBD_CMD_FLAG_FUA;

    if (request->type == NBD_CMD_READ && client->structured_reply) {
@@ -1482,12 +1482,6 @@ static coroutine_fn void nbd_trip(void *opaque) 


        break;

    case NBD_CMD_WRITE:

        if (exp->nbdflags & NBD_FLAG_READ_ONLY) {

            error_setg(&local_err, "Export is read-only");

            ret = -EROFS;

            break;

        }



        flags = 0;

        if (request.flags & NBD_CMD_FLAG_FUA) {

            flags |= BDRV_REQ_FUA;
@@ -1500,12 +1494,6 @@ static coroutine_fn void nbd_trip(void *opaque) 


        break;

    case NBD_CMD_WRITE_ZEROES:

        if (exp->nbdflags & NBD_FLAG_READ_ONLY) {

            error_setg(&local_err, "Export is read-only");

            ret = -EROFS;

            break;

        }



        flags = 0;

        if (request.flags & NBD_CMD_FLAG_FUA) {

            flags |= BDRV_REQ_FUA;