From: Christian Schoenebeck <qemu_oss@crudebyte.com>
To: qemu-devel@nongnu.org, Stefano Stabellini <sstabellini@kernel.org>
Cc: qemu-stable@nongnu.org, Greg Kurz <groug@kaod.org>,
Feifan Qian <bea1e@proton.me>,
Anthony PERARD <anthony@xenproject.org>,
"Edgar E. Iglesias" <edgar.iglesias@gmail.com>
Subject: Re: [PATCH 3/8] 9pfs/xen: implement msize_limit callback
Date: Fri, 12 Jun 2026 14:53:51 +0200 [thread overview]
Message-ID: <6275293.lOV4Wx5bFT@weasel> (raw)
In-Reply-To: <alpine.DEB.2.22.394.2606111638240.368315@ubuntu-linux-20-04-desktop>
On Friday, 12 June 2026 01:49:25 CEST Stefano Stabellini wrote:
> On Wed, 27 May 2026, Christian Schoenebeck wrote:
> > Add and implement the msize_limit callback for the Xen transport.
> >
> > The limit is calculated using XEN_FLEX_RING_SIZE() based on the
> > negotiated ring_order. For the theoretical maximum ring_order of 9,
> > this results in a maximum 'msize' of 1048576 bytes (1 MiB).
> >
> > Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
> > ---
[...]
> > +static size_t xen_9p_msize_limit(V9fsState *s)
> > +{
> > + Xen9pfsDev *xen_9pfs = container_of(s, Xen9pfsDev, state);
> > + return XEN_FLEX_RING_SIZE(xen_9pfs->rings[0].ring_order);
> > +}
>
> This is correct as a computation. But there are multiple rings with
> potentially different ring_orders (although I have never seen it in
> practice.)
>
> So I think something like this would be better:
>
> ---
> size_t limit = XEN_FLEX_RING_SIZE(xen_9pfs->rings[0].ring_order);
> for (i = 1; i < xen_9pfs->num_rings; i++) {
> limit = MIN(limit, XEN_FLEX_RING_SIZE(xen_9pfs->rings[i].ring_order));
> }
> return limit;
Agreed, I'll take your solution and just precede it with:
if (!xen_9pfs->num_rings) {
return 0;
}
I understand it is not really needed as min. one Xen ring is guaranteed, but
it's still a separate subsystem and it doesn't cost much.
/Christian
next prev parent reply other threads:[~2026-06-12 12:54 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-27 21:16 [PATCH 0/8] 9pfs: fix DoS via Treaddir (CVE-2026-9238) Christian Schoenebeck
2026-05-27 21:15 ` [PATCH 1/8] hw/9pfs: add msize_limit transport callback Christian Schoenebeck
2026-05-27 21:15 ` [PATCH 2/8] 9pfs/virtio: implement msize_limit callback Christian Schoenebeck
2026-05-27 21:15 ` [PATCH 3/8] 9pfs/xen: " Christian Schoenebeck
2026-06-08 7:43 ` Christian Schoenebeck
2026-06-11 3:11 ` Stefano Stabellini
2026-06-11 23:49 ` Stefano Stabellini
2026-06-12 12:53 ` Christian Schoenebeck [this message]
2026-05-27 21:15 ` [PATCH 4/8] hw/9pfs: cap negotiated msize to transport limit Christian Schoenebeck
2026-05-27 21:15 ` [PATCH 5/8] hw/9pfs: add response_buffer_size transport callback Christian Schoenebeck
2026-05-27 21:15 ` [PATCH 6/8] 9pfs/virtio: implement response_buffer_size callback Christian Schoenebeck
2026-05-27 21:15 ` [PATCH 7/8] 9pfs/xen: " Christian Schoenebeck
2026-06-12 0:23 ` Stefano Stabellini
2026-06-12 12:58 ` Christian Schoenebeck
2026-05-27 21:15 ` [PATCH 8/8] hw/9pfs: cap Treaddir allocation (CVE-2026-9238) Christian Schoenebeck
2026-06-12 0:23 ` Stefano Stabellini
2026-06-12 13:01 ` Christian Schoenebeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6275293.lOV4Wx5bFT@weasel \
--to=qemu_oss@crudebyte.com \
--cc=anthony@xenproject.org \
--cc=bea1e@proton.me \
--cc=edgar.iglesias@gmail.com \
--cc=groug@kaod.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
--cc=sstabellini@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.