[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2 2/9] 9pfs: validate count sent by client with T_readdir
From: |
Christian Schoenebeck |
Subject: |
[PATCH v2 2/9] 9pfs: validate count sent by client with T_readdir |
Date: |
Wed, 18 Dec 2019 14:17:59 +0100 |
A good 9p client sends T_readdir with "count" parameter that's
sufficiently smaller than client's initially negotiated msize
(maximum message size). We perform a check for that though to
avoid the server to be interrupted with a "Failed to encode
VirtFS reply type 41" error message by bad clients.
Note: we should probably also check for a minimum size of
msize during T_version to avoid issues and/or too complicated
count/size checks later on in other requests of that client.
T_version should submit an msize that's at least as large as
the largest request's header size.
Signed-off-by: Christian Schoenebeck <address@hidden>
---
hw/9pfs/9p.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 520177f40c..30e33b6573 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -2414,6 +2414,7 @@ static void coroutine_fn v9fs_readdir(void *opaque)
int32_t count;
uint32_t max_count;
V9fsPDU *pdu = opaque;
+ V9fsState *s = pdu->s;
retval = pdu_unmarshal(pdu, offset, "dqd", &fid,
&initial_offset, &max_count);
@@ -2422,6 +2423,13 @@ static void coroutine_fn v9fs_readdir(void *opaque)
}
trace_v9fs_readdir(pdu->tag, pdu->id, fid, initial_offset, max_count);
+ if (max_count > s->msize - P9_IOHDRSZ) {
+ max_count = s->msize - P9_IOHDRSZ;
+ warn_report_once(
+ "9p: bad client: T_readdir with count > msize - P9_IOHDRSZ"
+ );
+ }
+
fidp = get_fid(pdu, fid);
if (fidp == NULL) {
retval = -EINVAL;
--
2.20.1
- [PATCH v2 0/9] 9pfs: readdir optimization, Christian Schoenebeck, 2019/12/18
- [PATCH v2 9/9] hw/9pfs/9p.c: benchmark time on T_readdir request, Christian Schoenebeck, 2019/12/18
- [PATCH v2 4/9] tests/virtio-9p: added readdir test, Christian Schoenebeck, 2019/12/18
- [PATCH v2 7/9] hw/9pfs/9p-synth: avoid n-square issue in synth_readdir(), Christian Schoenebeck, 2019/12/18
- [PATCH v2 8/9] 9pfs: T_readdir latency optimization, Christian Schoenebeck, 2019/12/18
- [PATCH v2 1/9] tests/virtio-9p: add terminating null in v9fs_string_read(), Christian Schoenebeck, 2019/12/18
- [PATCH v2 2/9] 9pfs: validate count sent by client with T_readdir,
Christian Schoenebeck <=
- [PATCH v2 6/9] 9pfs: readdir benchmark, Christian Schoenebeck, 2019/12/18
- [PATCH v2 3/9] hw/9pfs/9p-synth: added directory for readdir test, Christian Schoenebeck, 2019/12/18
- [PATCH v2 5/9] tests/virtio-9p: check file names of R_readdir response, Christian Schoenebeck, 2019/12/18