[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH v3 3/4] nbd: Don't send oversize strings

From: Eric Blake
Subject: Re: [PATCH v3 3/4] nbd: Don't send oversize strings
Date: Fri, 15 Nov 2019 15:30:08 -0600
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.1.1

On 11/15/19 11:08 AM, Vladimir Sementsov-Ogievskiy wrote:
14.11.2019 5:46, Eric Blake wrote:
Qemu as server currently won't accept export names larger than 256
bytes, nor create dirty bitmap names longer than 1023 bytes, so most
uses of qemu as client or server have no reason to get anywhere near
the NBD spec maximum of a 4k limit per string.

However, we weren't actually enforcing things, ignoring when the
remote side violates the protocol on input, and also having several
code paths where we send oversize strings on output (for example,
qemu-nbd --description could easily send more than 4k).  Tighten
things up as follows:

- Perform bounds check on export name and dirty bitmap request prior
    to handing it to server
- Validate that copied server replies are not too long (ignoring
    NBD_INFO_* replies that are not copied is not too bad)
- Perform bounds check on export name and description prior to
    advertising it to client
- Reject client name or metadata query that is too long
- Adjust things to allow full 4k name limit rather than previous
    256 byte limit

Signed-off-by: Eric Blake <address@hidden>

Reviewed-by: Vladimir Sementsov-Ogievskiy <address@hidden>

Thanks; I'm queuing 1-3 in my NBD tree for -rc2.

Still, same doubt about putting over-sized strings into error messages. If you
decide to drop them, keep my r-b.


Not very simple to review, as I need to check that all assertions will not fire.
Hope you don't mind me doing it here)

Not at all; your thorough review is appreciated.

Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

reply via email to

[Prev in Thread] Current Thread [Next in Thread]