Re: [PATCH 1/6] io/channel-socket: do not treat a zero length write as an error

["Daniel P. Berrangé" <berrange@redhat.com>]

On Mon, Aug 31, 2026 at 12:01:46PM +0200, Denis V. Lunev wrote:
> From: Denis V. Lunev <den@openvz.org>
> 
> qio_channel_socket_writev() checks "ret <= 0" after sendmsg(). A zero
> length iovec is written successfully and returns 0, so the success
> falls into the errno switch, which acts on whatever the last failing
> syscall left in errno. A stale EAGAIN turns it into
> QIO_CHANNEL_ERR_BLOCK with errp untouched, and a caller which treats
> every negative return as fatal then passes a NULL Error to
> error_get_pretty(). The websocket handshake does exactly that, so an
> unauthenticated client crashes QEMU during the greeting.
> 
> Returning 0 is safe for callers which loop until everything is
> written. qio_channel_writev_full_all() has no zero progress guard, but
> iov_copy() yields no entries for a zero length write, so that loop is
> never entered. A connected stream socket returns 0 only when there is
> nothing to send.
> 
> The WIN32 implementation in the same file uses "ret < 0".
> 
> Fixes: 559607ea173a ("io: add QIOChannelSocket class")
> Cc: qemu-stable@nongnu.org
> Cc: Daniel P. Berrangé <berrange@redhat.com>
> Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
> Signed-off-by: Denis V. Lunev <den@openvz.org>
> ---
>  io/channel-socket.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

Though IMHO it is also a bug in the caller to request writing
of zero bytes.

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|