diff options
author | Paolo Bonzini | 2018-07-02 14:21:58 +0200 |
---|---|---|
committer | Paolo Bonzini | 2018-07-06 18:39:19 +0200 |
commit | ee8c13b81474e002db083e9692b11c0e106a9c7f (patch) | |
tree | d0a0eeaec479975e0cca19949429b2bbc9d562c2 /scripts/qapi/introspect.py | |
parent | Merge remote-tracking branch 'remotes/berrange/tags/qcrypto-next-pull-request... (diff) | |
download | qemu-ee8c13b81474e002db083e9692b11c0e106a9c7f.tar.gz qemu-ee8c13b81474e002db083e9692b11c0e106a9c7f.tar.xz qemu-ee8c13b81474e002db083e9692b11c0e106a9c7f.zip |
pr-helper: avoid error on PR IN command with zero request size
After reading a PR IN command with zero request size in prh_read_request,
the resp->result field will be uninitialized and the resp.sz field will
be also uninitialized when returning to prh_co_entry.
If resp->result == GOOD (from a previous successful reply or just luck),
then the assert in prh_write_response might not be triggered and
uninitialized response will be sent.
The fix is to remove the whole handling of sz == 0 in prh_co_entry.
Those errors apply only to PR OUT commands and it's perfectly okay to
catch them later in do_pr_out and multipath_pr_out; the check for
too-short parameters in fact doesn't apply in the easy SG_IO case, as
it can be left to the target firmware even.
The result is that prh_read_request does not fail requests anymore and
prh_co_entry becomes simpler.
Reported-by: Dima Stepanov <dimastep@yandex-team.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'scripts/qapi/introspect.py')
0 files changed, 0 insertions, 0 deletions