Blame SOURCES/kvm-nbd-client-Reject-inaccessible-tail-of-inconsistent-.patch

b38b0f
From e49b010d5f866b3ee7efbf40398f0a0832ce8801 Mon Sep 17 00:00:00 2001
b38b0f
From: Max Reitz <mreitz@redhat.com>
b38b0f
Date: Tue, 23 Jul 2019 14:45:43 +0100
b38b0f
Subject: [PATCH 05/14] nbd/client: Reject inaccessible tail of inconsistent
b38b0f
 server
b38b0f
b38b0f
RH-Author: Max Reitz <mreitz@redhat.com>
b38b0f
Message-id: <20190723144546.23701-5-mreitz@redhat.com>
b38b0f
Patchwork-id: 89649
b38b0f
O-Subject: [RHEL-8.1.0 qemu-kvm PATCH 4/7] nbd/client: Reject inaccessible tail of inconsistent server
b38b0f
Bugzilla: 1678979
b38b0f
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
b38b0f
RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
b38b0f
RH-Acked-by: John Snow <jsnow@redhat.com>
b38b0f
b38b0f
From: Eric Blake <eblake@redhat.com>
b38b0f
b38b0f
The NBD spec suggests that a server should never advertise a size
b38b0f
inconsistent with its minimum block alignment, as that tail is
b38b0f
effectively inaccessible to a compliant client obeying those block
b38b0f
constraints. Since we have a habit of rounding up rather than
b38b0f
truncating, to avoid losing the last few bytes of user input, and we
b38b0f
cannot access the tail when the server advertises bogus block sizing,
b38b0f
abort the connection to alert the server to fix their bug.  And
b38b0f
rejecting such servers matches what we already did for a min_block
b38b0f
that was not a power of 2 or which was larger than max_block.
b38b0f
b38b0f
Does not impact either qemu (which always sends properly aligned
b38b0f
sizes) or nbdkit (which does not send minimum block requirements yet);
b38b0f
so this is mostly aimed at new NBD server implementations, and ensures
b38b0f
that the rest of our code can assume the size is aligned.
b38b0f
b38b0f
Signed-off-by: Eric Blake <eblake@redhat.com>
b38b0f
Message-Id: <20190330155704.24191-1-eblake@redhat.com>
b38b0f
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
b38b0f
(cherry picked from commit 3add3ab78247fd347fd6f377a4b951022ac35d35)
b38b0f
Signed-off-by: Max Reitz <mreitz@redhat.com>
b38b0f
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
b38b0f
---
b38b0f
 nbd/client.c | 8 ++++++++
b38b0f
 1 file changed, 8 insertions(+)
b38b0f
b38b0f
diff --git a/nbd/client.c b/nbd/client.c
b38b0f
index 25603f2..c828faf 100644
b38b0f
--- a/nbd/client.c
b38b0f
+++ b/nbd/client.c
b38b0f
@@ -416,6 +416,14 @@ static int nbd_opt_go(QIOChannel *ioc, const char *wantname,
b38b0f
                 nbd_send_opt_abort(ioc);
b38b0f
                 return -1;
b38b0f
             }
b38b0f
+            if (info->min_block &&
b38b0f
+                !QEMU_IS_ALIGNED(info->size, info->min_block)) {
b38b0f
+                error_setg(errp, "export size %" PRIu64 "is not multiple of "
b38b0f
+                           "minimum block size %" PRIu32, info->size,
b38b0f
+                           info->min_block);
b38b0f
+                nbd_send_opt_abort(ioc);
b38b0f
+                return -1;
b38b0f
+            }
b38b0f
             be16_to_cpus(&info->flags);
b38b0f
             trace_nbd_receive_negotiate_size_flags(info->size, info->flags);
b38b0f
             break;
b38b0f
-- 
b38b0f
1.8.3.1
b38b0f