diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2018-07-02 14:21:58 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2018-07-06 18:39:19 +0200 |
| commit | ee8c13b81474e002db083e9692b11c0e106a9c7f (patch) | |
| tree | d0a0eeaec479975e0cca19949429b2bbc9d562c2 /chardev/char-socket.c | |
| parent | 2a018f6e98782a4931b936a3087404ed81685bac (diff) | |
| download | focaccia-qemu-ee8c13b81474e002db083e9692b11c0e106a9c7f.tar.gz focaccia-qemu-ee8c13b81474e002db083e9692b11c0e106a9c7f.zip | |
pr-helper: avoid error on PR IN command with zero request size
After reading a PR IN command with zero request size in prh_read_request, the resp->result field will be uninitialized and the resp.sz field will be also uninitialized when returning to prh_co_entry. If resp->result == GOOD (from a previous successful reply or just luck), then the assert in prh_write_response might not be triggered and uninitialized response will be sent. The fix is to remove the whole handling of sz == 0 in prh_co_entry. Those errors apply only to PR OUT commands and it's perfectly okay to catch them later in do_pr_out and multipath_pr_out; the check for too-short parameters in fact doesn't apply in the easy SG_IO case, as it can be left to the target firmware even. The result is that prh_read_request does not fail requests anymore and prh_co_entry becomes simpler. Reported-by: Dima Stepanov <dimastep@yandex-team.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'chardev/char-socket.c')
0 files changed, 0 insertions, 0 deletions