[Qemu-devel] [PATCH v3] v9fs_walk: As per 9p2000 RFC, MAXWELEM >= nwnames >= 0.

[Qemu-devel] [PATCH v3] v9fs_walk: As per 9p2000 RFC, MAXWELEM >= nwnames >= 0.

[Harsh Prateek Bora]

The nwnames field in TWALK message is assumed to be >=0 and <= MAXWELEM
which is defined as macro P9_MAXWELEM (16) in virtio-9p.h as per 9p2000
RFC. Appropriate changes are required in V9fsWalkState and v9fs_walk.

v3:
- Updated if-else conditions to appropriately handle nwnames = 0.

v2:
- Added check in v9fs_walk_complete as well. 

Signed-off-by: Harsh Prateek Bora <harsh@linux.vnet.ibm.com>
---
 hw/9pfs/virtio-9p.c |    7 +++++--
 hw/9pfs/virtio-9p.h |    2 +-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/9pfs/virtio-9p.c b/hw/9pfs/virtio-9p.c
index 6c06bb3..1d49970 100644
--- a/hw/9pfs/virtio-9p.c
+++ b/hw/9pfs/virtio-9p.c
@@ -1621,7 +1621,7 @@ static void v9fs_walk_complete(V9fsState *s, V9fsWalkState *vs, int err)
 {
     complete_pdu(s, vs->pdu, err);
 
-    if (vs->nwnames) {
+    if (vs->nwnames && vs->nwnames <= P9_MAXWELEM) {
         for (vs->name_idx = 0; vs->name_idx < vs->nwnames; vs->name_idx++) {
             v9fs_string_free(&vs->wnames[vs->name_idx]);
         }
@@ -1717,7 +1717,7 @@ static void v9fs_walk(V9fsState *s, V9fsPDU *pdu)
     vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "ddw", &fid,
                                             &newfid, &vs->nwnames);
 
-    if (vs->nwnames) {
+    if (vs->nwnames && vs->nwnames <= P9_MAXWELEM) {
         vs->wnames = qemu_mallocz(sizeof(vs->wnames[0]) * vs->nwnames);
 
         vs->qids = qemu_mallocz(sizeof(vs->qids[0]) * vs->nwnames);
@@ -1726,6 +1726,9 @@ static void v9fs_walk(V9fsState *s, V9fsPDU *pdu)
             vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "s",
                                             &vs->wnames[i]);
         }
+    } else if (vs->nwnames >= P9_MAXWELEM) {
+        err = -EINVAL;
+        goto out;
     }
 
     vs->fidp = lookup_fid(s, fid);
diff --git a/hw/9pfs/virtio-9p.h b/hw/9pfs/virtio-9p.h
index 6c6931e..34f9bb3 100644
--- a/hw/9pfs/virtio-9p.h
+++ b/hw/9pfs/virtio-9p.h
@@ -289,7 +289,7 @@ typedef struct V9fsStatStateDotl {
 typedef struct V9fsWalkState {
     V9fsPDU *pdu;
     size_t offset;
-    int16_t nwnames;
+    uint16_t nwnames;
     int name_idx;
     V9fsQID *qids;
     V9fsFidState *fidp;
-- 
1.7.1.1

[Qemu-devel] Re: [PATCH v3] v9fs_walk: As per 9p2000 RFC, MAXWELEM >= nwnames >= 0.

[Stefan Hajnoczi]

On Tue, Apr 5, 2011 at 6:56 AM, Harsh Prateek Bora
<harsh@linux.vnet.ibm.com> wrote:
> The nwnames field in TWALK message is assumed to be >=0 and <= MAXWELEM
> which is defined as macro P9_MAXWELEM (16) in virtio-9p.h as per 9p2000
> RFC. Appropriate changes are required in V9fsWalkState and v9fs_walk.
>
> v3:
> - Updated if-else conditions to appropriately handle nwnames = 0.
>
> v2:
> - Added check in v9fs_walk_complete as well.
>
> Signed-off-by: Harsh Prateek Bora <harsh@linux.vnet.ibm.com>
> ---
>  hw/9pfs/virtio-9p.c |    7 +++++--
>  hw/9pfs/virtio-9p.h |    2 +-
>  2 files changed, 6 insertions(+), 3 deletions(-)

hw/virtio-9p.c

I think you've submitted a patch against an internal tree that isn't upstream.

Stefan

[Qemu-devel] Re: [PATCH v3] v9fs_walk: As per 9p2000 RFC, MAXWELEM >= nwnames >= 0.

[Harsh Bora]

On 04/05/2011 02:24 PM, Stefan Hajnoczi wrote:
> On Tue, Apr 5, 2011 at 6:56 AM, Harsh Prateek Bora
> <harsh@linux.vnet.ibm.com>  wrote:
>> The nwnames field in TWALK message is assumed to be>=0 and<= MAXWELEM
>> which is defined as macro P9_MAXWELEM (16) in virtio-9p.h as per 9p2000
>> RFC. Appropriate changes are required in V9fsWalkState and v9fs_walk.
>>
>> v3:
>> - Updated if-else conditions to appropriately handle nwnames = 0.
>>
>> v2:
>> - Added check in v9fs_walk_complete as well.
>>
>> Signed-off-by: Harsh Prateek Bora<harsh@linux.vnet.ibm.com>
>> ---
>>   hw/9pfs/virtio-9p.c |    7 +++++--
>>   hw/9pfs/virtio-9p.h |    2 +-
>>   2 files changed, 6 insertions(+), 3 deletions(-)
>
> hw/virtio-9p.c
>
> I think you've submitted a patch against an internal tree that isn't upstream.

Yes, it is based on a patch yet to be merged in mainline by Aneesh which 
will move 9p files into a separate folder, however, I shall repost an 
updated version of the patch based on current directory structure.

regards,
Harsh
>
> Stefan