[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 51/55] nbd/server: fix nbd_negotiate_handle_info
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 51/55] nbd/server: fix nbd_negotiate_handle_info |
Date: |
Wed, 6 Dec 2017 13:16:44 -0600 |
From: Vladimir Sementsov-Ogievskiy <address@hidden>
namelen should be here, length is unrelated, and always 0 at this
point. Broken in introduction in commit f37708f6, but mostly
harmless (replying with '' as the name does not violate protocol,
and does not confuse qemu as the nbd client since our implementation
does not ask for the name; but might confuse some other client that
does ask for the name especially if the default export is different
than the export name being queried).
Adding an assert makes it obvious that we are not skipping any bytes
in the client's message, as well as making it obvious that we were
using the wrong variable.
Signed-off-by: Vladimir Sementsov-Ogievskiy <address@hidden>
CC: address@hidden
Message-Id: <address@hidden>
[eblake: improve commit message, squash in assert addition]
Signed-off-by: Eric Blake <address@hidden>
(cherry picked from commit 46321d6b5f8c880932a6b3d07bd0ff6f892e665c)
Signed-off-by: Michael Roth <address@hidden>
---
nbd/server.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/nbd/server.c b/nbd/server.c
index 56aed3a735..5042cc4786 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -434,6 +434,7 @@ static int nbd_negotiate_handle_info(NBDClient *client,
uint32_t length,
break;
}
}
+ assert(length == 0);
exp = nbd_export_find(name);
if (!exp) {
@@ -444,7 +445,7 @@ static int nbd_negotiate_handle_info(NBDClient *client,
uint32_t length,
/* Don't bother sending NBD_INFO_NAME unless client requested it */
if (sendname) {
- rc = nbd_negotiate_send_info(client, opt, NBD_INFO_NAME, length, name,
+ rc = nbd_negotiate_send_info(client, opt, NBD_INFO_NAME, namelen, name,
errp);
if (rc < 0) {
return rc;
--
2.11.0
- [Qemu-stable] [PATCH 38/55] net: fix check for number of parameters to -netdev socket, (continued)
- [Qemu-stable] [PATCH 38/55] net: fix check for number of parameters to -netdev socket, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 39/55] nbd/client: Use error_prepend() correctly, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 41/55] virtio: Add queue interface to restore avail index from vring used index, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 43/55] hw/ppc: clear pending_events on machine reset, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 46/55] block/nfs: fix nfs_client_open for filesize greater than 1TB, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 48/55] nbd/server: CVE-2017-15119 Reject options larger than 32M, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 45/55] scripts/make-release: ship u-boot source as a tarball, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 47/55] virtio-net: don't touch virtqueue if vm is stopped, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 04/55] kvmclock: use the updated system_timer_msr, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 49/55] nbd/server: CVE-2017-15118 Stack smash on large export name, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 51/55] nbd/server: fix nbd_negotiate_handle_info,
Michael Roth <=
- [Qemu-stable] [PATCH 50/55] vhost: fix error check in vhost_verify_ring_mappings(), Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 55/55] vga: handle cirrus vbe mode wraparounds., Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 52/55] nbd-client: Refuse read-only client with BDRV_O_RDWR, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 54/55] vga: drop line_offset variable, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 53/55] nbd/client: Don't hard-disconnect on ESHUTDOWN from server, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 05/55] block: Perform copy-on-read in loop, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 06/55] exec: Explicitly export target AS from address_space_translate_internal, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 08/55] memory: Move FlatView allocation to a helper, Michael Roth, 2017/12/06
- [Qemu-stable] [PATCH 07/55] memory: Open code FlatView rendering, Michael Roth, 2017/12/06