Blame SOURCES/kvm-nbd-client-Reject-inaccessible-tail-of-inconsistent-.patch

7711c0
From c03c9a78664b0f3e27bba21167e621d5068feb0b Mon Sep 17 00:00:00 2001
7711c0
From: John Snow <jsnow@redhat.com>
7711c0
Date: Mon, 6 May 2019 17:56:20 +0200
7711c0
Subject: [PATCH 10/53] nbd/client: Reject inaccessible tail of inconsistent
7711c0
 server
7711c0
7711c0
RH-Author: John Snow <jsnow@redhat.com>
7711c0
Message-id: <20190506175629.11079-11-jsnow@redhat.com>
7711c0
Patchwork-id: 87183
7711c0
O-Subject: [RHEL-7.7 qemu-kvm-rhev PATCH 10/19] nbd/client: Reject inaccessible tail of inconsistent server
7711c0
Bugzilla: 1692018
7711c0
RH-Acked-by: Max Reitz <mreitz@redhat.com>
7711c0
RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
7711c0
RH-Acked-by: Thomas Huth <thuth@redhat.com>
7711c0
7711c0
From: Eric Blake <eblake@redhat.com>
7711c0
7711c0
The NBD spec suggests that a server should never advertise a size
7711c0
inconsistent with its minimum block alignment, as that tail is
7711c0
effectively inaccessible to a compliant client obeying those block
7711c0
constraints. Since we have a habit of rounding up rather than
7711c0
truncating, to avoid losing the last few bytes of user input, and we
7711c0
cannot access the tail when the server advertises bogus block sizing,
7711c0
abort the connection to alert the server to fix their bug.  And
7711c0
rejecting such servers matches what we already did for a min_block
7711c0
that was not a power of 2 or which was larger than max_block.
7711c0
7711c0
Does not impact either qemu (which always sends properly aligned
7711c0
sizes) or nbdkit (which does not send minimum block requirements yet);
7711c0
so this is mostly aimed at new NBD server implementations, and ensures
7711c0
that the rest of our code can assume the size is aligned.
7711c0
7711c0
Signed-off-by: Eric Blake <eblake@redhat.com>
7711c0
Message-Id: <20190330155704.24191-1-eblake@redhat.com>
7711c0
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
7711c0
(cherry picked from commit 3add3ab78247fd347fd6f377a4b951022ac35d35)
7711c0
Signed-off-by: John Snow <jsnow@redhat.com>
7711c0
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
7711c0
---
7711c0
 nbd/client.c | 8 ++++++++
7711c0
 1 file changed, 8 insertions(+)
7711c0
7711c0
diff --git a/nbd/client.c b/nbd/client.c
7711c0
index 10a52ad..4309569 100644
7711c0
--- a/nbd/client.c
7711c0
+++ b/nbd/client.c
7711c0
@@ -426,6 +426,14 @@ static int nbd_opt_info_or_go(QIOChannel *ioc, uint32_t opt,
7711c0
                 nbd_send_opt_abort(ioc);
7711c0
                 return -1;
7711c0
             }
7711c0
+            if (info->min_block &&
7711c0
+                !QEMU_IS_ALIGNED(info->size, info->min_block)) {
7711c0
+                error_setg(errp, "export size %" PRIu64 "is not multiple of "
7711c0
+                           "minimum block size %" PRIu32, info->size,
7711c0
+                           info->min_block);
7711c0
+                nbd_send_opt_abort(ioc);
7711c0
+                return -1;
7711c0
+            }
7711c0
             trace_nbd_receive_negotiate_size_flags(info->size, info->flags);
7711c0
             break;
7711c0
 
7711c0
-- 
7711c0
1.8.3.1
7711c0