From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56257) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X0Wsl-0003wh-15 for qemu-devel@nongnu.org; Fri, 27 Jun 2014 10:12:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X0Wsf-0006ri-2Y for qemu-devel@nongnu.org; Fri, 27 Jun 2014 10:12:02 -0400 Sender: Paolo Bonzini From: Paolo Bonzini Date: Fri, 27 Jun 2014 16:11:43 +0200 Message-Id: <1403878306-22683-3-git-send-email-pbonzini@redhat.com> In-Reply-To: <1403878306-22683-1-git-send-email-pbonzini@redhat.com> References: <1403878306-22683-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PULL 2/5] nbd: Don't validate from and len in NBD_CMD_DISC. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org, Hani Benhabiles From: Hani Benhabiles These values aren't used in this case. Currently, the from field in the request sent by the nbd kernel module leading to a false error message when ending the connection with the client. $ qemu-nbd some.img -v // After nbd-client -d /dev/nbd0 nbd.c:nbd_trip():L1031: From: 18446744073709551104, Len: 0, Size: 20971520, Offset: 0 nbd.c:nbd_trip():L1032: requested operation past EOF--bad client? nbd.c:nbd_receive_request():L638: read failed Signed-off-by: Hani Benhabiles Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini --- nbd.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/nbd.c b/nbd.c index e0d032c..8d8bc40 100644 --- a/nbd.c +++ b/nbd.c @@ -1001,6 +1001,7 @@ static void nbd_trip(void *opaque) struct nbd_request request; struct nbd_reply reply; ssize_t ret; + uint32_t command; TRACE("Reading request."); if (client->closing) { @@ -1023,8 +1024,8 @@ static void nbd_trip(void *opaque) reply.error = -ret; goto error_reply; } - - if ((request.from + request.len) > exp->size) { + command = request.type & NBD_CMD_MASK_COMMAND; + if (command != NBD_CMD_DISC && (request.from + request.len) > exp->size) { LOG("From: %" PRIu64 ", Len: %u, Size: %" PRIu64 ", Offset: %" PRIu64 "\n", request.from, request.len, @@ -1033,7 +1034,7 @@ static void nbd_trip(void *opaque) goto invalid_request; } - switch (request.type & NBD_CMD_MASK_COMMAND) { + switch (command) { case NBD_CMD_READ: TRACE("Request type is READ"); -- 1.8.3.1