summary refs log tree commit diff stats
path: root/chardev/char-socket.c
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2018-07-02 14:21:58 +0200
committerPaolo Bonzini <pbonzini@redhat.com>2018-07-06 18:39:19 +0200
commitee8c13b81474e002db083e9692b11c0e106a9c7f (patch)
treed0a0eeaec479975e0cca19949429b2bbc9d562c2 /chardev/char-socket.c
parent2a018f6e98782a4931b936a3087404ed81685bac (diff)
downloadfocaccia-qemu-ee8c13b81474e002db083e9692b11c0e106a9c7f.tar.gz
focaccia-qemu-ee8c13b81474e002db083e9692b11c0e106a9c7f.zip
pr-helper: avoid error on PR IN command with zero request size
After reading a PR IN command with zero request size in prh_read_request,
the resp->result field will be uninitialized and the resp.sz field will
be also uninitialized when returning to prh_co_entry.

If resp->result == GOOD (from a previous successful reply or just luck),
then the assert in prh_write_response might not be triggered and
uninitialized response will be sent.

The fix is to remove the whole handling of sz == 0 in prh_co_entry.
Those errors apply only to PR OUT commands and it's perfectly okay to
catch them later in do_pr_out and multipath_pr_out; the check for
too-short parameters in fact doesn't apply in the easy SG_IO case, as
it can be left to the target firmware even.

The result is that prh_read_request does not fail requests anymore and
prh_co_entry becomes simpler.

Reported-by: Dima Stepanov <dimastep@yandex-team.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'chardev/char-socket.c')
0 files changed, 0 insertions, 0 deletions