From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40771) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1alk3D-0001ls-MM for qemu-devel@nongnu.org; Thu, 31 Mar 2016 17:22:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1alk3A-0000c0-GP for qemu-devel@nongnu.org; Thu, 31 Mar 2016 17:22:47 -0400 Received: from resqmta-po-06v.sys.comcast.net ([96.114.154.165]:35944) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1alk3A-0000bZ-Ca for qemu-devel@nongnu.org; Thu, 31 Mar 2016 17:22:44 -0400 From: Eric Blake Date: Thu, 31 Mar 2016 15:20:22 -0600 Message-Id: <1459459222-8637-4-git-send-email-eblake@redhat.com> In-Reply-To: <1459459222-8637-1-git-send-email-eblake@redhat.com> References: <1459459222-8637-1-git-send-email-eblake@redhat.com> Subject: [Qemu-devel] [PATCH 3/3] nbd: Reject unknown request flags List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Paolo Bonzini The NBD protocol says that clients should not send a command flag that has not been negotiated (whether by the client requesting an option during a handshake, or because we advertise support for the flag in response to NBD_OPT_EXPORT_NAME), and that servers should reject invalid flags with EINVAL. We were silently ignoring the flags instead. The client can't rely on our behavior, since it is their fault for passing the bad flag in the first place, but it's better to be robust up front than to possibly behave differently than the client was expecting with the attempted flag. Signed-off-by: Eric Blake --- nbd/server.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nbd/server.c b/nbd/server.c index a590773..31bd9c5 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -974,6 +974,10 @@ static ssize_t nbd_co_receive_request(NBDRequest *req, struct nbd_request *reque goto out; } + if (request->flags & ~NBD_CMD_FLAG_FUA) { + LOG("unsupported flags (got 0x%x)", request->flags); + return -EINVAL; + } if ((request->from + request->len) < request->from) { LOG("integer overflow detected! " "you're probably being attacked"); -- 2.5.5