From patchwork Fri Apr 26 08:33:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_P=C3=B6tzsch?= X-Patchwork-Id: 13644324 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id CF988C4345F for ; Fri, 26 Apr 2024 08:34:18 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1s0H1H-00020a-KV; Fri, 26 Apr 2024 04:33:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1s0H1F-00020C-Si for qemu-devel@nongnu.org; Fri, 26 Apr 2024 04:33:21 -0400 Received: from serv1.kernkonzept.com ([2a01:4f8:1c1c:b490::2] helo=mx.kernkonzept.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1s0H1C-00014u-Tb for qemu-devel@nongnu.org; Fri, 26 Apr 2024 04:33:21 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=kernkonzept.com; s=mx1; h=Content-Transfer-Encoding:Content-Type: MIME-Version:Message-Id:Date:Subject:Cc:To:From:References:In-Reply-To: Reply-To:Content-ID:Content-Description; bh=3T3uC+uPxOU/vifPXjSQcrQgSVb5h9+GqYbWLNEU9n4=; b=im+eObZrn+KM3xsguizL4j5Lhw U8+453pvkgsV2BT77odvbMUdIw+AiusUtaHnMmR/55waq1PtuBXEtuQrtFc1EAWCUxy/qJ37J97D4 dJMBlbsZdWNoRAWcfNAADSo9yDs9a94Vh7B36eDXvMC5kOUTtde/r6PQSSmQhmw4lNqXDv+fgVSJT IfHc1jnvcTOQ2EmYglvKcRuaf/OADk2ywPy4y3qZQq13JqoRxmgnZAxeZB8/g5dlNgsdwdt9FwuVb 8NlYD363jzRO/SgrNUZpg2PQlLH+MRlwhgXTiagCEzLmQn6Ba3NFf2NSMR/iR8UuBqID6OHFRUA51 ZQ1OVyMQ==; Received: from pd9fe93de.dip0.t-ipconnect.de ([217.254.147.222] helo=iris.dd1.int.kernkonzept.com) by mx.kernkonzept.com with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) id 1s0H19-00F3kg-19; Fri, 26 Apr 2024 10:33:15 +0200 From: =?utf-8?q?Christian_P=C3=B6tzsch?= To: qemu-devel@nongnu.org Cc: "Michael S. Tsirkin" , =?utf-8?q?Christian_P=C3=B6tzsch?= Subject: [PATCH] Fix vhost user assertion when sending more than one fd Date: Fri, 26 Apr 2024 10:33:13 +0200 Message-Id: <20240426083313.3081272-1-christian.poetzsch@kernkonzept.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 Received-SPF: pass client-ip=2a01:4f8:1c1c:b490::2; envelope-from=christian.poetzsch@kernkonzept.com; helo=mx.kernkonzept.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org If the client sends more than one region this assert triggers. The reason is that two fd's are 8 bytes and VHOST_MEMORY_BASELINE_NREGIONS is exactly 8. The assert is wrong because it should not test for the size of the fd array, but for the numbers of regions. Signed-off-by: Christian Pötzsch --- subprojects/libvhost-user/libvhost-user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvhost-user/libvhost-user.c index a879149fef..8adb277d54 100644 --- a/subprojects/libvhost-user/libvhost-user.c +++ b/subprojects/libvhost-user/libvhost-user.c @@ -568,7 +568,7 @@ vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) { fd_size = cmsg->cmsg_len - CMSG_LEN(0); vmsg->fd_num = fd_size / sizeof(int); - assert(fd_size < VHOST_MEMORY_BASELINE_NREGIONS); + assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); memcpy(vmsg->fds, CMSG_DATA(cmsg), fd_size); break; }