Re: [Qemu-devel] [PATCH v2 3/9] virtio-9p: handle handle_9p_output() error

[Cornelia Huck]

On Wed, 21 Sep 2016 18:57:12 +0200
Greg Kurz <address@hidden> wrote:

> A broken guest may send a request with only non-empty out buffers
> or only non-empty in buffers, virtqueue_pop() will then return a
> VirtQueueElement with out_num == 0 or in_num == 0 respectively.
> 
> All 9P requests are expected to start with the following 7-byte header:
> 
>             uint32_t size_le;
>             uint8_t id;
>             uint16_t tag_le;
> 
> If iov_to_buf() fails to return these 7 bytes, then something is wrong in
> the guest.
> 
> In both cases, it is wrong to crash QEMU, since the root cause lies in the
> guest. Let's switch the device to the broken state instead.
> 
> Signed-off-by: Greg Kurz <address@hidden>
> ---
> v2: - added out_free_pdu: label for errors or when virtqueue is empty
> ---
>  hw/9pfs/virtio-9p-device.c |   20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)

Reviewed-by: Cornelia Huck <address@hidden>