[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v3 03/11] 9pfs: validate count sent by client with T_readdir
From: |
Greg Kurz |
Subject: |
Re: [PATCH v3 03/11] 9pfs: validate count sent by client with T_readdir |
Date: |
Thu, 16 Jan 2020 14:33:42 +0100 |
On Mon, 13 Jan 2020 23:22:08 +0100
Christian Schoenebeck <address@hidden> wrote:
> A good 9p client sends T_readdir with "count" parameter that's
> sufficiently smaller than client's initially negotiated msize
> (maximum message size). We perform a check for that though to
> avoid the server to be interrupted with a "Failed to encode
> VirtFS reply type 41" error message by bad clients.
>
> Signed-off-by: Christian Schoenebeck <address@hidden>
> ---
> hw/9pfs/9p.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> index a5fbe821d4..30da2fedf3 100644
> --- a/hw/9pfs/9p.c
> +++ b/hw/9pfs/9p.c
> @@ -2426,6 +2426,7 @@ static void coroutine_fn v9fs_readdir(void *opaque)
> int32_t count;
> uint32_t max_count;
> V9fsPDU *pdu = opaque;
> + V9fsState *s = pdu->s;
>
> retval = pdu_unmarshal(pdu, offset, "dqd", &fid,
> &initial_offset, &max_count);
> @@ -2434,6 +2435,13 @@ static void coroutine_fn v9fs_readdir(void *opaque)
> }
> trace_v9fs_readdir(pdu->tag, pdu->id, fid, initial_offset, max_count);
>
> + if (max_count > s->msize - P9_IOHDRSZ) {
P9_IOHDRSZ relates to Twrite. The Rreaddir message has a smaller header
of size 11:
size[4] Rreaddir tag[2] count[4]
> + max_count = s->msize - P9_IOHDRSZ;
> + warn_report_once(
> + "9p: bad client: T_readdir with count > msize - P9_IOHDRSZ"
> + );
> + }
> +
> fidp = get_fid(pdu, fid);
> if (fidp == NULL) {
> retval = -EINVAL;
- [PATCH v3 00/11] 9pfs: readdir optimization, Christian Schoenebeck, 2020/01/13
- [PATCH v3 05/11] tests/virtio-9p: added readdir test, Christian Schoenebeck, 2020/01/13
- [PATCH v3 08/11] 9pfs: readdir benchmark, Christian Schoenebeck, 2020/01/13
- [PATCH v3 01/11] tests/virtio-9p: add terminating null in v9fs_string_read(), Christian Schoenebeck, 2020/01/13
- [PATCH v3 02/11] 9pfs: require msize >= 4096, Christian Schoenebeck, 2020/01/13