From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=38374 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1P3Yge-0007pS-G9
	for qemu-devel@nongnu.org; Wed, 06 Oct 2010 14:25:57 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <jvrao@linux.vnet.ibm.com>) id 1P3Ygb-00009U-Rx
	for qemu-devel@nongnu.org; Wed, 06 Oct 2010 14:25:56 -0400
Received: from e36.co.us.ibm.com ([32.97.110.154]:59892)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <jvrao@linux.vnet.ibm.com>) id 1P3Ygb-00009B-Mo
	for qemu-devel@nongnu.org; Wed, 06 Oct 2010 14:25:53 -0400
Received: from d03relay01.boulder.ibm.com (d03relay01.boulder.ibm.com
	[9.17.195.226])
	by e36.co.us.ibm.com (8.14.4/8.13.1) with ESMTP id o96ILiCo012265
	for <qemu-devel@nongnu.org>; Wed, 6 Oct 2010 12:21:44 -0600
Received: from d03av02.boulder.ibm.com (d03av02.boulder.ibm.com [9.17.195.168])
	by d03relay01.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id
	o96IPoT2112006
	for <qemu-devel@nongnu.org>; Wed, 6 Oct 2010 12:25:50 -0600
Received: from d03av02.boulder.ibm.com (loopback [127.0.0.1])
	by d03av02.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP
	id o96IPn4u019504
	for <qemu-devel@nongnu.org>; Wed, 6 Oct 2010 12:25:49 -0600
Message-ID: <4CACBF2B.3050901@linux.vnet.ibm.com>
Date: Wed, 06 Oct 2010 11:25:47 -0700
From: "Venkateswararao Jujjuri (JV)" <jvrao@linux.vnet.ibm.com>
MIME-Version: 1.0
Subject: Re: [Qemu-devel] virtio-9p.c:401: v9fs_string_sprintf: Assertion
	`!(err == -1)' failed.
References: <4CAC7037.80301@redhat.com>
	<AANLkTikQmwtfS51XFEXh-sxrHZeP3KEUVRd9Vj5kg+kj@mail.gmail.com>
In-Reply-To: <AANLkTikQmwtfS51XFEXh-sxrHZeP3KEUVRd9Vj5kg+kj@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Hajnoczi <stefanha@gmail.com>
Cc: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>, Gerd Hoffmann <kraxel@redhat.com>

On 10/6/2010 7:42 AM, Stefan Hajnoczi wrote:
> On a related note, there are more uses of BUG_ON() in hw/virtio-9p.c
> which can be triggered from the guest:
> 
> submit_pdu():
>     BUG_ON(pdu->id >= ARRAY_SIZE(pdu_handlers));
>     BUG_ON(handler == NULL);
> 
> handle_9p_output():
>         BUG_ON(pdu->elem.out_num == 0 || pdu->elem.in_num == 0);
>         BUG_ON(pdu->elem.out_sg[0].iov_len < 7);
> 

yeah.. these BUG_ONs make sense only if we "trust" the client.

> These should be handled by skipping the bad virtqueue element.  We
> could also reset the device but that may freak out the (bad) guest.

May be log an error and skip it?  Reset is not a bad idea..if we decided to punish
the client for sending something that is not acceptable. .. any comments?

- JV

> 
> Stefan
>