From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DB08DC624D3 for ; Fri, 4 Sep 2026 11:01:03 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x2ReL-0004af-ML; Fri, 04 Sep 2026 07:00:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x2ReJ-0004ZX-T0 for qemu-devel@nongnu.org; Fri, 04 Sep 2026 06:59:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x2ReI-0007d9-JR for qemu-devel@nongnu.org; Fri, 04 Sep 2026 06:59:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788519598; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=90HkXVzu7ZLEuo0XZqsDoRCf5zysB6xWietFG/AXiGs=; b=YWY4gbsVCqfcuEYESddzb6SkM5BsUYSzHSlxHQ7nIZO8+7tuzkwu3487WxH0tvM7SjfzK+ 9uqUy3TXuaWwURNwMuKtfb/h07wgXf1ZE2YDjkwzygxirqGsheH9yPh6PeeZMBvowhnkSm +4B6M50f4Sa8HvpJPlVlJ6zyoJQNyP8= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-197-zu2pHs--PBW-acsT5Qis7A-1; Fri, 04 Sep 2026 06:59:54 -0400 X-MC-Unique: zu2pHs--PBW-acsT5Qis7A-1 X-Mimecast-MFC-AGG-ID: zu2pHs--PBW-acsT5Qis7A_1788519593 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 69E5718DEBBB; Fri, 4 Sep 2026 10:59:53 +0000 (UTC) Received: from berrange.csb (headnet03.pony-001.prod.iad2.dc.redhat.com [10.2.32.114]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 6CA3618001D0; Fri, 4 Sep 2026 10:59:51 +0000 (UTC) From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Alex=20Benn=C3=A9e?= , Pierrick Bouvier , devel@lists.libvirt.org, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , qemu-stable@nongnu.org, "Denis V. Lunev" Subject: [PULL 08/13] io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading Date: Fri, 4 Sep 2026 11:59:24 +0100 Message-ID: <20260904105929.3450663-9-berrange@redhat.com> In-Reply-To: <20260904105929.3450663-1-berrange@redhat.com> References: <20260904105929.3450663-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 12 X-Spam_score: 1.2 X-Spam_bar: + X-Spam_report: (1.2 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org From: Denis V. Lunev qio_channel_websock_handshake_read() folds every negative return from qio_channel_read() into -1. QIO_CHANNEL_ERR_BLOCK leaves errp unset, so qio_channel_websock_handshake_io() then hands a NULL Error to error_get_pretty() and QEMU dies. The master channel is non-blocking and, for a wss:// client, is a TLS channel. A G_IO_IN wakeup carrying only part of a TLS record makes gnutls report EAGAIN, which is all it takes to reach this before the client has authenticated. ERR_BLOCK here means the headers are not complete yet, which is what a 0 return already tells the caller. Report it that way and keep waiting. The watch is level triggered, so an incomplete record sitting in the socket spins the main loop until the rest of it arrives. That is bounded by the round trip and is what every reader layered over TLS already does. Fixes: 2d1d0e70cf3e ("io: add QIOChannelWebsock class") Fixes: CVE-2026-84788 Cc: qemu-stable@nongnu.org Cc: Daniel P. Berrangé Cc: Marc-André Lureau Reviewed-by: Daniel P. Berrangé Reviewed-by: Marc-André Lureau Signed-off-by: Denis V. Lunev Signed-off-by: Daniel P. Berrangé --- io/channel-websock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/io/channel-websock.c b/io/channel-websock.c index 8f27b1f12b..461abcae48 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -492,6 +492,9 @@ static int qio_channel_websock_handshake_read(QIOChannelWebsock *ioc, buffer_reserve(&ioc->encinput, want); ret = qio_channel_read(ioc->master, (char *)buffer_end(&ioc->encinput), want, errp); + if (ret == QIO_CHANNEL_ERR_BLOCK) { + return 0; + } if (ret < 0) { return -1; } -- 2.55.0