From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrey Zhadchenko Date: Tue, 18 Aug 2026 18:09:16 +0300 Subject: [Devel] [PATCH VZ10 1/5] drivers/vhost/blk: harden get_id command In-Reply-To: <20260818150920.13123-1-andrey.zhadchenko@virtuozzo.com> References: <20260818150920.13123-1-andrey.zhadchenko@virtuozzo.com> Message-ID: <20260818150920.13123-2-andrey.zhadchenko@virtuozzo.com> List-Id: A defensive patch. QEMU is fine with reporting empty serial and including null terminator. So we will do the same. https://virtuozzo.atlassian.net/browse/VSTOR-138640 Signed-off-by: Andrey Zhadchenko --- drivers/vhost/blk.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c index dac03566bfca5..edd3e75873ff5 100644 --- a/drivers/vhost/blk.c +++ b/drivers/vhost/blk.c @@ -105,8 +105,6 @@ struct vhost_blk { pid_t owner_pid; }; -static int gen; - static int move_iovec(struct iovec *from, struct iovec *to, size_t len, int iov_count_from, int iov_count_to) { @@ -491,7 +489,9 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq, ret = vhost_blk_req_submit(req); break; case VIRTIO_BLK_T_GET_ID: - len = strnlen(blk->serial, VIRTIO_BLK_ID_BYTES); + len = min_t(size_t, + strnlen(blk->serial, VIRTIO_BLK_ID_BYTES) + 1, + min_t(size_t, req->len, VIRTIO_BLK_ID_BYTES)); iov_iter_init(&iter, ITER_DEST, req->iov, req->iov_nr, req->len); ret = copy_to_iter(blk->serial, len, &iter); status = ret != len ? VIRTIO_BLK_S_IOERR : VIRTIO_BLK_S_OK; @@ -688,7 +688,6 @@ static int vhost_blk_open(struct inode *inode, struct file *file) } memset(blk->serial, 0, sizeof(blk->serial)); - snprintf(blk->serial, VIRTIO_BLK_ID_BYTES, "vhost-blk%d", gen++); atomic_set(&blk->req_inflight[0], 0); atomic_set(&blk->req_inflight[1], 0); -- 2.43.5