[PATCH for-11.2 v2 0/3] Avoid low-severity NBD denial-of-service attack

[Eric Blake <eblake@redhat.com>]

AI found a way to trip an assertion failure by sending a particular
BLOCK_STATUS command in violation of the NBD protocol, documented at
https://gitlab.com/qemu-project/qemu/-/work_items/3796 and again at
https://gitlab.com/qemu-project/qemu/-/work_items/4091. Since the
attack can be trivially avoided by using TLS + x509 certificates to
avoid untrusted clients avoiding the protocol non-compliance, I'm
posting the patch now, rather than waiting for a CVE assignment, per
https://www.qemu.org/contribute/security-process/

v1: https://lists.nongnu.org/archive/html/qemu-devel/2026-11/msg01615.html
- since then, adjust wording based on Dan's feedback
- add the NBD fix and a unit test

Eric Blake (3):
  docs: Mention security considerations for NBD
  nbd/server: Reject rather than assert on non-compliant BLOCK_STATUS
  iotests: Add new nbd-robustness test

 docs/system/security.rst                    |  21 +++
 nbd/server.c                                |   4 +-
 tests/qemu-iotests/tests/nbd-robustness     | 137 ++++++++++++++++++++
 tests/qemu-iotests/tests/nbd-robustness.out |   5 +
 4 files changed, 165 insertions(+), 2 deletions(-)
 create mode 100755 tests/qemu-iotests/tests/nbd-robustness
 create mode 100644 tests/qemu-iotests/tests/nbd-robustness.out

-- 
2.56.0