[PATCH v2 2/3] nbd/server: Reject rather than assert on non-compliant BLOCK_STATUS

[Eric Blake <eblake@redhat.com>]

The NBD spec is clear that a client must not send NBD_BLOCK_STATUS
requests to a server if it did not negotiate any metacontexts with
NBD_OPT_SET_META_CONTEXT.  However, if the non-compliant client uses
NBD_OPT_EXTENDED_HEADERS and then passes in the relatively new
NBD_CMD_FLAG_PAYLOAD_LEN flag alongside an inappropriate block status
request, this was enough to trigger an assertion in qemu.

If you do not use recommended practice to prevent untrusted clients
from connecting to QEMU's NBD server, then you are at risk of a denial
of service attack from a rogue client.  Per our stated policy on flaws
triggered by network connections, this is considered a low-severity
security flaw, since it is trivial to avoid by using proper
configuration of TLS and x509 certificate authorization to reject
rogue clients; therefore, no CVE has been assigned yet.

Fixes: 2dcbb11b ("nbd/server: Add FLAG_PAYLOAD support to CMD_BLOCK_STATUS", v8.2.0)
Reported-by: Feifan Qian <bea1e@proton.me>
Reported-by: https://gitlab.com/qemu-project/qemu/-/work_items/3796
CC: Haotian Jiang <jianghaotian.sunday@gmail.com>
CC: qemu-stable@nongnu.org
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 nbd/server.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nbd/server.c b/nbd/server.c
index e6c47f8c2e3..bc37cbcb338 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -2584,12 +2584,12 @@ nbd_co_block_status_payload_read(NBDClient *client, NBDRequest *request,
         return -EINVAL;
     }

-    assert(client->contexts.exp == client->exp);
     nr_bitmaps = client->exp->nr_export_bitmaps;
     request->contexts = g_new0(NBDMetaContexts, 1);
     request->contexts->exp = client->exp;

-    if (payload_len % sizeof(uint32_t) ||
+    if (!client->contexts.count ||
+        payload_len % sizeof(uint32_t) ||
         payload_len < sizeof(NBDBlockStatusPayload) ||
         payload_len > (sizeof(NBDBlockStatusPayload) +
                        sizeof(id) * client->contexts.count)) {
-- 
2.56.0