From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from PAXPR08MB6605.eurprd08.prod.outlook.com (2603:10a6:102:153::24) by PAXPR08MB6942.eurprd08.prod.outlook.com with HTTPS; Mon, 31 Aug 2026 14:06:43 +0000 Received: from AS4P191CA0007.EURP191.PROD.OUTLOOK.COM (2603:10a6:20b:5d5::7) by PAXPR08MB6605.eurprd08.prod.outlook.com (2603:10a6:102:153::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Mon, 31 Aug 2026 14:06:39 +0000 Received: from AMS0EPF000001B5.eurprd05.prod.outlook.com (2603:10a6:20b:5d5:cafe::9) by AS4P191CA0007.outlook.office365.com (2603:10a6:20b:5d5::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Mon, 31 Aug 2026 14:06:38 +0000 Authentication-Results: spf=softfail (sender IP is 99.81.216.78) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning openvz.org discourages use of 99.81.216.78 as permitted sender) Received: from nat.eu.perception-point.io (99.81.216.78) by AMS0EPF000001B5.mail.protection.outlook.com (10.167.16.169) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Mon, 31 Aug 2026 14:06:36 +0000 X-PERCEPTION-POINT-VERDICT: CLN X-PERCEPTION-POINT-SPF: X-PERCEPTION-POINT-SPAM: PASS X-PERCEPTION-POINT-SENDER-IP: 2a00:1450:4864:20::333 X-PP-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::333;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x333.google.com;PTR:mail-wm1-x333.google.com;CAT:NONE;SFS:(13230040)(704160211799003)(3072899012)(2092899012)(43022699015)(6059299003)(12012899012)(82310400026)(5063699009)(10067099003)(19002099009)(57112099003)(16102099003)(18002099003)(55112099003)(13003099007);DIR:INB; Received: from DUZPR08CU001.outbound.protection.outlook.com (mail-duzpr08cu00100.outbound.protection.outlook.com [40.93.64.64]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id vkj8fnfjrh7cvj6j2v48pvo80ni7hbq0v8qa96g1; Mon, 31 Aug 2026 14:06:33 +0000 (UTC) X-SES-Spam-Verdict: PASS X-SES-Virus-Verdict: PASS Received-SPF: softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.64 as permitted sender) client-ip=40.93.64.64; envelope-from=den@openvz.org; helo=DUZPR08CU001.outbound.protection.outlook.com; Authentication-Results-Original: amazonses.com; spf=softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.64.64 as permitted sender) client-ip=40.93.64.64; envelope-from=den@openvz.org; helo=DUZPR08CU001.outbound.protection.outlook.com; dkim=pass header.i=@openvz.org; dmarc=pass header.from=openvz.org; X-SES-RECEIPT: AEFBQUFBQUFBQUFFRE5Ld1JsZHRMNVBLT2pDWWhRcFFwcy9jcEtiTE1FV2NWRkU4eUlXWkdWZ2VxZi9xcXo4aWRsVkhjc2swNkNlaGp6TnUxODY2MW45SkpYdG9nTkp4b1hRV2IxUVdiUXNRcjVUTEZTQ0ZzTmZLb3Z0Y1BmZkRrRzYwdExwZ0R6VE51dXZIc3FXMlFMNDZmWks3Rks3WUJVQmlnNHgvSEdZcUNGU3lvU253MGhEMDZOczFOWXZiTjdWejJzMUgwbzdKVDFmT1M0UFo2V3ZRdkgrb1crQk1zMnV6SFlxSVdkOXVzb2ptU1RYSWRkbnRNTEYvMnhBdkRFUXNtY2xpSjdmTUxIQjNxK3BudTFtdGNwRm5XV29hOUJQWDd6WnVhMmdyVmxxdEVLZEtLeXc9PQ== X-SES-DKIM-SIGNATURE: a=rsa-sha256; q=dns/txt; b=uyU4/8pTCzqOTxcyK2nwO2FWdLOqqjeXhn4y7lNpbj2xj5xpDpovHgz/COPGWp4goEdLxMmZxDKUiiNRh1iP8eWDgQLoZ0lFzdvBVEBObhwGbfm4iDM25gZKioC+2KxIEcKRSau6+znB0ocJA79f5taHW+CGq2bRIMYT4fK7DME=; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1788185193; v=1; bh=Hdim0pj6zfRHOa/PfzM2OkI/9WQzAi4EqZUUxUBHc8w=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT; Received: from PA7P264CA0398.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:39b::21) by DU5PR08MB10437.eurprd08.prod.outlook.com (2603:10a6:10:524::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Mon, 31 Aug 2026 14:06:25 +0000 Received: from AM7PEPF00000057.EURPRD83.prod.outlook.com (2603:10a6:102:39b:cafe::91) by PA7P264CA0398.outlook.office365.com (2603:10a6:102:39b::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Mon, 31 Aug 2026 14:06:25 +0000 Authentication-Results-Original: spf=pass (sender IP is 2a00:1450:4864:20::333) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::333 as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::333; helo=mail-wm1-x333.google.com; pr=C Received: from mail-wm1-x333.google.com (2a00:1450:4864:20::333) by AM7PEPF00000057.mail.protection.outlook.com (2603:10a6:20f:fff8::21b) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.0 via Frontend Transport; Mon, 31 Aug 2026 14:06:24 +0000 Received: by mail-wm1-x333.google.com with SMTP id 5b1f17b1804b1-49557167508so37284905e9.1 for ; Mon, 31 Aug 2026 07:06:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1788185184; x=1788789984; darn=virtuozzo.com; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=imnVmJ6RNDMpE/buP+CiNwcurABbnXbw3e/h6YdVFik=; b=Cwb30q6/PwxYG0dz6z0VMVqP3PFzePc1FWMfJE8NCVoOr+OwfLefrr5Sbn4JTIV9FO 0HX7Nbl/MDwbIXw7fBB2WKRnsnwEFf6ew7QMbqhMQflca0mCzYVkrntn4Y93AXcRUjrH KH6iOlgUwAfwxy9fSuL3lo6qfL1+stZz8woRou420Y/g9slxKMRR/FawRO5fd0nzrOCk 2ZhxdVI2hLwnzgta41oZ0HEPOcaHtGC9vNrbxTfhCxjdf+liRko/ya1Esfk1WSRrge+D F57rRepPPmEU+qvOAI/N95HDxg5JPaXwsQtSnW3PcseyNO4WkQoM7TWWMSbmGqnwq5p/ 8syA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788185184; x=1788789984; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=imnVmJ6RNDMpE/buP+CiNwcurABbnXbw3e/h6YdVFik=; b=DAL2lwqJytU2mHye7M7k/0LmrKsWknFIj+NqwoIMMqN9km40myKG+czQ/pDdGAK5No mujGg3+ZMViCjf165TgiCRncIBi1kTX6t3AUds745zzu5KwrxgYduvkSZgWUCBpscqe9 Pd/CjKwugWQsO9Zlv08MWb63LSI9feNJsBh2Q+eAUltdLDQUbCbo8MaW2VPK5knSZF4A OJLTg3jRbzFPRirM6kx9ntSt/Wz+74Ml3rl6uPWzXxLO19M6w4T1EqNACziZ+Z30L1e3 O3OTamGruUxTUfDxXXbRSihDa59y4SuutmwP9oyNUbwehlRiuWGMu4XPuSIwbG8Il4Ab nHuw== X-Gm-Message-State: AFuF++nWUbLs5RajWNzUiBMrvAcZ9WmSmJ5t/IukHahAAvsVC3Ro4i+X LJbKe8BBhTkgmN2BXn5YWyNc37AZrcqGRD6Kc32+wNSHhOjb9sWVvXrJcPG9ILz3drPMXB+Py24 MmHPq548= X-Gm-Gg: AR+sD122MoVjbp+OMz5IaMpW5bUVBQUS6qGhgvXhAST3WQVv0vLrjhr4XGHyI1E/uH6 TDMCNalkfcJZIc+fnTfhvMFROg8NsIOjl7WlRvFBhAhe5wWX2txpmZshiu68mSY1/anVpNkHjTl 3RJ/PzF73NNvHS8DqFFpBIcjV6da897NCJ8PJt+AJegWZ851DMY6K9TYdm4Z5PgkJ1qZQvC00jW Iax7Yg0dtZ2/LeLSnvwSocXItUQJwC6IXVUYmq8X8h2qLjvZqqiTHPI09wTFE1tD216BmDZKX/Z Tncn83NICoZqeqavZcF/oBH1koc3C3je5WpUpRkzWrdQDk9oIQOxVzODVsXVNZ+Or4KFNY1U0YP J/7v9/HaZXdBxLktHY4K9bztnqqNZT/TSWJDBS9b7h4Q/Y0l6ae1VeSLC0Pg8+aD0t0UQAjElIc 3iGzfyS3oHE6fwsWAXcpuWxzvbWludsmZhBQ0yklMay5WX1U5+EBTku+cr X-Received: by 2002:a05:600c:3b2a:b0:49c:cee0:e7c1 with SMTP id 5b1f17b1804b1-49cdc57d1d1mr11272815e9.16.1788185183976; Mon, 31 Aug 2026 07:06:23 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:3bc1:c53b:30b:203e]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482fbb33070sm23644536f8f.36.2026.08.31.07.06.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 31 Aug 2026 07:06:23 -0700 (PDT) From: "Denis V. Lunev" To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.0 0/6] io/channel-websock: fix an unauthenticated crash in the handshake #VSTOR-143316 Date: Mon, 31 Aug 2026 16:06:14 +0200 Message-ID: <20260831140620.1204363-1-den@openvz.org> X-Mailer: git-send-email 2.53.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 1 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:1 X-MS-TrafficTypeDiagnostic: AM7PEPF00000057:EE_|DU5PR08MB10437:EE_|AMS0EPF000001B5:EE_|PAXPR08MB6605:EE_|PAXPR08MB6942:EE_ X-MS-Office365-Filtering-Correlation-Id: ff73fbfd-bb1b-4930-589e-08df07691285 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA|SL X-PERCEPTION-POINT-CUSTOM: vzpp X-Microsoft-Antispam-Untrusted: BCL:0;ARA:13230040|704160211799003|3072899012|2092899012|43022699015|6059299003|12012899012|82310400026|5063699009|10067099003|19002099009|57112099003|16102099003|18002099003|55112099003|13003099007; X-Microsoft-Antispam-Message-Info-Original: =?utf-8?B?SmZEM2ZpTmFjSUZ4SG1NMmtOTE9vckZ4aUNwMWQ1YndVQ29rT3p4MmMrU1JD?= =?utf-8?B?aUFNV3dYVlZCbU9PNUwrc2RROUhuK0tMQ2hGclV0YUhzYUVPM0Zmd2JObVBq?= =?utf-8?B?RytGUmdrMlpnTzRKV0ttbUVPdDZ2SmQ5MUtuUVhoUjBtWkxDUG0wUldPOHNJ?= =?utf-8?B?U2pOY2drVEU0VGp5NStYbHdjenRPMGFxT29IMlgzaEVXOG5zOEh3M2RxamxP?= =?utf-8?B?VUNDWGoyWnBHUGhVek9TWHdtVlNTWTZlaktvYmI4Y1U0Yy9Qdm5CTE83aWdD?= =?utf-8?B?ZGpmZW85K2N0N0tPdUFpc2svRmVqUHovOHMxV2t4M0JQbXJsbU4vaFh5Qjhp?= =?utf-8?B?SkMvZ1VlY2NkRDBZUWV2bG9BaXRoK0tXdWF5LzRXMWRwc0ptQmxSclpyVGEv?= =?utf-8?B?NTV3aXhMTDg1YVVFL1ZReGF6TDNSblZsZWxMcTA3R09JbmpMVkpyOVorWDJr?= =?utf-8?B?RDhhMEcrT3hFTHdhdWZKUFNHaThydWV1dUtHeGx2NGFBa1djZm04SzhCQXp6?= =?utf-8?B?UUhhT0c5QjNMYXVrcFV3bUZrOFNIQ3VRa2tTd3d6TEV5b254a3hLWUl3MGEz?= =?utf-8?B?Rnh6aTFwRDdDeVFaYkdKVXBuOXN6TnBOK1NGcTM1ZCtsajIxUkQ4ejRjcGFp?= =?utf-8?B?NlBOM3NhN01tbGVHZlBUU2E5VW52Zy9tN04wUURodTd5ZmNWTENROFIzVnQy?= =?utf-8?B?Szhab1V1VXZvR04zWGR1aTRGRFg5YkJPQU5CbDhkMDdySitBbUxlUmlPTEwr?= =?utf-8?B?eWZranlxUGY3QmJNNlJ2bVRRRkxNNTdsRkJCRlJoY29iTFl3MUlZdDNua0tm?= =?utf-8?B?K1p5enhxM3BnaGJWQjRSVFBxbjVncEIza3IrVmNEejZzNnRxOHdoS05qKzdH?= =?utf-8?B?djJQcTQ5NzI2MTJFVmNqdU5ndTVIQjdTRnlYSWN1SXhkWWNyKzU4WnBZZUUz?= =?utf-8?B?UkZlRkdqeVZJOUMvZkRzL3BFTHpUUmZPbmZ6Z0tiSW9NcEROZGt6d2lta09J?= =?utf-8?B?cUcxRVNYZmx0aXI3NHlWN21JTmRTK1o5MTFTUFpseGtxY21UMkZ4b04yWXl5?= =?utf-8?B?Z2tzUGkzVDFsSjRTZmpIQmRvRVpTdGFQSExsdklVdnhraWIxV2Nqb1JuRG1L?= =?utf-8?B?ZGRZY1ZuTW43OGxEaDJaWGhNQTlxa2FJSjVKM3o2eGVNS1FmNTJFYUhHeFlk?= =?utf-8?B?eUZFMkViZFd4aERuS1dMV0VvSHBjSkxkSzhNUVRJdkZiTzlaUDhDM2RabEl1?= =?utf-8?B?Um1hSXd2dzFXczM2M05zb3ZTU3dLcS92TnIyd29QcEc4Z3JiR29jUVZUYjZR?= =?utf-8?B?UVpQR0dxaVFzVVBpMFgzbDB3Wi9BRDQ2MU9vbFJwZnVCSmNLa0lHMXB4UjRt?= =?utf-8?B?ZTZ0K05BZTM4OW0vYU1FMXp5VTdGaVdjKzN6TWROaXUwTUVsem1Yby9zYUNI?= =?utf-8?B?WGpSKytIZzUvZnN5MTJWWkU0VGdnS3pQdU5NZnpIRUJsMmcvR1dFdjBVL0xW?= =?utf-8?B?eCswQkIrVGpxUHdvU1RpRDZqK2VpUVppcm1PRThTRU1WTjYyaXpxMHVXdDRx?= =?utf-8?B?YThWZFZmOTRYSkRYWUtiZXRMaU5HNWxQc0ZRYkxtK0Y3N2JGVU9kWUM2cjdZ?= =?utf-8?B?aDdSSWZrekN2TVlXeE5HMkpLN2N1Q1BpL1dHd1MvQWZud3AvUHRuQkZmNUtl?= =?utf-8?B?a28zZDl6TjluQU12RWJvSHZZSmFKVm10bGxNQ1c3NjNqUkk0Y0FYZWNPMG9h?= =?utf-8?B?emZIaHpYQUVlaVpRWDR0S2plVVdhci9YcSt5a3haNXRxYUZBN1pOV0NtTzRC?= =?utf-8?B?bC85c2k3MlptdTFZM240dkdIZFREM2ZpT0lwS05SSENJQXBOaVkxRCs2SzdC?= =?utf-8?B?Qkg4ZDhXMFRXK3lkK3pyNFE2bitJcmxYMFVDYlBPRk1TdUFvUVhMdzdUZi9L?= =?utf-8?B?OWlBRWFZc2E1OUxuczJhUnp3ZzVqRGpkMnlVbGJiemVseUJZdlp1ckFweFFV?= =?utf-8?B?Q3I2clNiYzB2ZzBkUkE3OWVqbkgzbU9iZTlBMHc3KzArNy9vam5iNFdIdHR6?= =?utf-8?B?VzF5QUFNdWdwY3lpb1MvdDBEc3lKTXlFdmhGU2hZanpDUWR1S0RRczc3V1pO?= =?utf-8?B?ckpaQm1IaElmekhRWXVRYk50SWU1bkRrbUZHbXJRb20weE1hQk5nZXNRdk1E?= =?utf-8?B?YS9ZcEUremRER3RPOE1qV05XSmR3d002OGFpWUpWVEhxOGx5Y3luRG1KZ0xh?= =?utf-8?B?U1JJVmRhWU43b2VVMXY0WlFOYXV0WVNlZHQ2cUxzUW9UNlBuK0ZsMGc5VlZw?= =?utf-8?B?OTRCV2lxeFBvczk4UmY1bXAvK1lXRG5sUjk5ZHM1YnpZZEpzMm9IeTUyOE41?= =?utf-8?B?UmNhWG1YT3pyRFNVRDRRWnFvY3o4L25vOEYwdVBWazdyQVBWNSttUFNCWDAz?= =?utf-8?B?eGs5R3d1T2R2VlJhUFU1YXVCQ2p0cUxLWjNZbDh4VlZNcFIycWQxU1F5ZjlE?= =?utf-8?B?aHN4aW5NZXl0UnRzMGRQazJIQXM5NTUzYWlmTjVHUWFaN3IwRjlTV2lSUWVs?= =?utf-8?B?ZHJoUDdTNnROZ2YyT1ZMYW1vM21SNGdsOXBLaUJRTjhCWldMbVpCeVdOUnFK?= =?utf-8?B?TFpoN3ZZalB1b2RENUtSdVd4VHV6bFFkcFAxYWRoYjdGWGpZOEtFTnlraTEv?= =?utf-8?B?TVdBdmxhcjlYYU5NR0EyYkdCWE5OM0ZodWJ1QVFXcUUzVkhpMXh0VzFrZk8x?= =?utf-8?B?K1RUL3Y4eEFuZ3hBN1ZHS29oRk54REtlVDFxQ05LN0pja2J0N0M0YnlPTE5j?= =?utf-8?Q?olSJI9IZ1DKdr1rIZ+p9E=3D?= X-Forefront-Antispam-Report-Untrusted: CIP:2a00:1450:4864:20::333;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x333.google.com;PTR:mail-wm1-x333.google.com;CAT:NONE;SFS:(13230040)(704160211799003)(3072899012)(2092899012)(43022699015)(6059299003)(12012899012)(82310400026)(5063699009)(10067099003)(19002099009)(57112099003)(16102099003)(18002099003)(55112099003)(13003099007);DIR:INB; X-Auto-Response-Suppress: DR, OOF, AutoReply X-Exchange-RoutingPolicyChecked: ZOU6Z2b+axwGr+sltv7SsO8+OLRuy3JtvxtZZ5ghxAY0axwOoCiYa+WhPntlKE+iIagLdp87TC8BtL3U2Ik+6ZK4LXJWs69d5FI0yg3R9+4dfeF/NUztCJVExWemJngWVsrYf684CoY7TlLGid52qgP5as8maTlHx/hB0nP8NmJbfJMWDonOIlkD9iSFChy37kezmVV6pYiDztLQ/m8ObNEiLhMZhDnQEzx35a2jTbFIBdWCrmhepd8ip6Dz3zj/OGlbSsBJe7A3xRar3nnrhsjA7Xo88xPeigNBpt4vLk5um8zN/NG78IgSu+5PTp2GGPCq52MuDAcZMxklScDdog== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU5PR08MB10437 X-MS-Exchange-Organization-ExpirationStartTime: 31 Aug 2026 14:06:37.3589 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: ff73fbfd-bb1b-4930-589e-08df07691285 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-Exchange-Transport-CrossTenantHeadersStripped: AMS0EPF000001B5.eurprd05.prod.outlook.com X-MS-PublicTrafficType: Email X-MS-Exchange-Organization-AuthSource: AMS0EPF000001B5.eurprd05.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id-Prvs: 44213ff1-28b2-4606-5cb4-08df07690b25 X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:0;ARA:13230040|704160211799003|82310400026|6059299003|43022699015|12012899012|2092899012|3072899012|35042699022|16102099003|5133699003|55112099003|57112099003|5063699009|13003099007|18003699003|10067099003|19002099009; X-Forefront-Antispam-Report: CIP:99.81.216.78;CTRY:IE;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:nat.eu.perception-point.io;PTR:nat2.eu.perception-point.io;CAT:NONE;SFS:(13230040)(704160211799003)(82310400026)(6059299003)(43022699015)(12012899012)(2092899012)(3072899012)(35042699022)(16102099003)(5133699003)(55112099003)(57112099003)(5063699009)(13003099007)(18003699003)(10067099003)(19002099009);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Aug 2026 14:06:36.6731 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ff73fbfd-bb1b-4930-589e-08df07691285 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AMS0EPF000001B5.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXPR08MB6605 X-MS-Exchange-Transport-EndToEndLatency: 00:00:06.5926259 X-MS-Exchange-Processed-By-BccFoldering: 15.21.0382.004 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(930201)(20251009189)(140003); X-Microsoft-Antispam-Message-Info: =?utf-8?B?WUFsREU1ZUhYcURMN3VnQWRaNWtWU240UG5qUllPQ1AxbWVyVUdkcDlsa1p6?= =?utf-8?B?Tng1QTMyV2lRb0dIc1djbjNKYmVHUUo5K0JiZ3hUY3RpbFVSVmtMV29xM1Bq?= =?utf-8?B?WTV0bmtrR3ludjVtNGNza3FDMllyazkrcHhOWVFtRFE0LzQxYjl4WGNsZDd5?= =?utf-8?B?Um5UbmptUXJLV2FsT3AzeHBFb2hESzNZUlpQeXBSYTRxdkZkK1JtY2J2UUd4?= =?utf-8?B?RHNkQitiZXRmZFh3elpGUGhiTFZzL2gyZnlYTkpKNmVjWWpLZ2RvcTdXSUxj?= =?utf-8?B?U2labWlQbTdpckFDTWkzYmJyWjdwS01ucElTdTBSTlVYbGRBYnlkS0VySlpG?= =?utf-8?B?ZjU5c3JoNkN4eWNObHlMc0NsYVpIekFlUlVDMTY3ZHk0b2xDNktFS0oyK2dN?= =?utf-8?B?emYxeXloc0htdWR2M1EyU2tPK2VmRHFZVWwvM0NMZHdsNEpORU9TREFaTTdK?= =?utf-8?B?bGZjaXQwcGhaVTZrRnYrZjY1L0RvYWtDYVMxSDdxcDdTV2N5aUZRR1N6a2pP?= =?utf-8?B?Y1pSZUJCVmdEcFNWeGpMR3RSUFNGZXdsZCttenJMY3R3bkZKVzZiTUlVZUcy?= =?utf-8?B?bkhaUE1vc1R0UjNlalVKUnRyUHl3VGlJeW1NaU50Q1lUREx0NVNxQlROcWdW?= =?utf-8?B?cEcvZGtFTmJISHA3Q2hheDczd2pmVFhMODRweE1iZU5JS29mSTBZcXQyOGgz?= =?utf-8?B?VjNsbC8vbmljZDY5b3F2Q1h4dHJveWJTT1E0enUreDlvRHliSXoxNDJEY2tF?= =?utf-8?B?L2lHMkJ4U2I3WlFrbmk5MEFiOG9XeFc0STdPczBYQlR0SXNoVzA5SEZheU1y?= =?utf-8?B?cHN6UHhER09LMU9VMnB4bHI3c2IyMTZyUnRSYkxPeXZQUmh4NWlNbm4vZUVO?= =?utf-8?B?YjZwRFdtQzFoSDVZNjMxdnJKREtzT0dLYkt1QTJ6V3dxUElHNmtURDBOMnox?= =?utf-8?B?U2lUNCs0dVRWcjlzR2xpR0FVellkQjAwSDJOSXRQTWhYZnV2UEp4SEpuOGYz?= =?utf-8?B?YkNHakRLRDVlTnNCeFJOalNYYzhGNnY3TUJXTWlNSm9KRzM5WkNaUlRVQzdo?= =?utf-8?B?aU5uTUdrNHU2SGR2Tk5SR0I3aEtQcDlMVzJadWdUM2JySXZRTmpRcVMxUHFN?= =?utf-8?B?TXJFTWNzNUVVTGsyL3crWlVHYjV5dUpCWVBRamtxR3ppWDJ4dHViYWJhNmx6?= =?utf-8?B?WXdaK1pXeFVqUWJVcHNCVXQzc1hnUTBoa2dZN3lINVVTS0dMVVVVTElIanUw?= =?utf-8?B?TXNneGhZeGVQWnBja0ZSOE5xQnF4SWRxNVVxSEs3ZDYwa2kzdy9xRmpQQ2gw?= =?utf-8?B?OFp3YU1YcVByUHpZNno3alZ4Z0d4Y3dYVDAvZVVmRzM2M3VhRkJPMnI2dmU2?= =?utf-8?B?TWwwdG5CNkNvTklPWm55RVAvMVk4b1pFU3A5OG9FN0prblZ3Sk9rNTZmUldl?= =?utf-8?B?V0orYWU2ZzQrK3pxYW9OcnNFdThodjNrWFh6R090bExReDgzYzlMeHNkYkhP?= =?utf-8?B?Tk44cEZiZ3ZsMVZ2WVF4YStVQmtKZGNyYitlZE50clpuWXoxby8yVjU4aHZ5?= =?utf-8?B?VE1DQ1N1cktTS29ERXlNNkNhdTIwbUE2Z2YyVjR0am8wZnUxQ2MxcTZUREk0?= =?utf-8?B?b0I1Mi9XL2xFdDk0UkNuUmlFeDBXM0FMZUNTOU9tV0JDUGVCbjZ0SVRSZ2t5?= =?utf-8?B?YllJK2tSd2FrOTFaT0tyL1RDL3FqaXNyWFhkbWRnSGtrcXAvSXNpajVmeXUr?= =?utf-8?B?ZVFOZGJZWTllOWhTdm00UzBaTjBxdXNPNm9ReFRpNlAxOWdSSkVKV21nSWd2?= =?utf-8?B?RklkQ3hyOUtnZStNTnptSzRaMmZZcGhBam53Y0RrSVUrN3pFaUFiVDl0UHZo?= =?utf-8?B?dzlKdERZS3ZHTWx4dDBGWWNLMUdSbFQ1T1lmNi9iSXQvYjNtVGszZVRDaEtX?= =?utf-8?B?WUtxYzFqUWZIOVNocHJ0TjdxVDBWUnQ2eEs4WkF3Y3ZCWG5tUHB6V2NWdThu?= =?utf-8?B?c2tEUEdMd29jN2ozZ1I5S2RmamJjcWorWmdrbS9kUURZcHR3NlpSaVNaM0ls?= =?utf-8?B?STNvdVNoc1RrNzBYek5jVXh6NFROWmFDd25Tdk02SUVvUFA4K081REYyOGgx?= =?utf-8?B?ajVBUlFTT2p6aHE4MURYYXlxTG54WU8vdVd5bnlWVVB1NFQ3V1RBeWpVa0tx?= =?utf-8?B?TkZZNkQ2blVad2xzVFFjcGNJRWgzRTdyYlIyc09vN0hiQjZGWXNRTlIzNUdE?= =?utf-8?B?RExHUlR4V09ZQko5QXp4eWs3WEVxZmpYN2tqVnlZOEliUTNnRTVrUnF1NDhv?= =?utf-8?B?QlZyKzFBc21BZkdwamFySjhrZ0Z3Y00zcG9xQXFVTTJPTjY4S1hFamZPSkdr?= =?utf-8?B?N0IzTlZOWHJMRUU4Tk1NejhnMVBudHAvVmpqUE5vN3JCNERRZ1did29vcEY3?= =?utf-8?B?eEZ5SEFLQkcxVHhXWWNIUEFUSzdKeEpWeVJyblU3VjZIYWd6elg2d3hYWE0r?= =?utf-8?B?eDczdjV4dGhaMHB1S2VLc1l4WEsyaDRaWnJiS0UwTVc2RjFtdkxtbHltdkp0?= =?utf-8?B?YTcwRGp6WU82eWRKOEtzM0JoTnNUTnhlN3pscmpWMlFXSTdBNFpsdHdHN1B4?= =?utf-8?B?Sm9KWm5RbTFYOXVCeDBpQ25DV3Q5MGNocEJETnJiL0RhNHVVK3h6cHZxR2tl?= =?utf-8?B?S1R6RkcyNmMrdDRYa1R3TDVmcFBRajFoN2VRTzFWVGhiRG1wa2NIUzRBUFhy?= =?utf-8?B?SitiWUJVRjZoSTNZUWk5c2NIWnFIeGNPNEgxQkpiRnFRU1phWkFlQW9XVHlM?= =?utf-8?B?NFdDekR6OWVoNE15TUNSd1BBVzlQNWk0akI2V2VybHMwR3ZaekNUV3pDRFhF?= =?utf-8?B?M2dJaDQ0d3lPY2pqZUhPOFNsaU1CMmVFMDFDYitjbnlaWkk2M2JlRGtiaWxI?= =?utf-8?B?R1lZRFVocUFMaHBxT084RzBYclhKSzFkVXFzMCtFdG5VVVM2Z294clJoUVla?= =?utf-8?B?T0pEeUhtU0luWGg2QWFQMUhEMllTZGQrc0Z4TWRMcWFiOWJveG9FRGxiWktH?= =?utf-8?B?QUF1a2Q5MFExQjdZTk5sNnkzWjJhSEZ1NXdzdFo2SEpXN0hRUWxBZHFldzFS?= =?utf-8?B?K3RnYXBQL21yOGJKTXFuUlNjTSs1ZGV5eVVxeVBqeUFzb3RrVmQ4RC9sZFN1?= =?utf-8?B?RmJEUFRJVS9rekpOVm95WG1PM3h0Rmpsb081WTZZMDRqak4vNFcwRlNBQXF4?= =?utf-8?B?U2FGRzQ2OFcrQndSck1VTnVuWGpNVlEyajRpZnNSbmtuY2daTXRib0lMazN3?= =?utf-8?B?UXBoY3d2MUI4YXB5YnRiYnl6cERwNHBhd3BHRTVJaHQxeGhRMXBQdjJCOEp0?= =?utf-8?B?UlVWVkIzZ0ZueWhBdFJrZVppNFNiZElTT0gyR09CcHUvVDFHU3BtVExYdz09?= MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: QEMU List-Id: Backport of the upstream series fixing an unauthenticated crash in the VNC websocket handshake. A client which can reach a websocket port crashes QEMU before it has authenticated, by sending an HTTP greeting whose request line holds no space: printf 'stats\r\nx\r\n\r\n' | nc $host $port Three defects line up to produce it. The greeting is rejected without queueing a response, so the handshake goes on to flush an empty buffer. A zero length sendmsg() succeeds and returns 0, which qio_channel_socket_writev() mistakes for failure and reports as QIO_CHANNEL_ERR_BLOCK with errp left unset. The handshake treats every negative return as fatal and hands that NULL Error to error_get_pretty(). Patches 1 to 3 close the three links. Patch 5 is the same NULL Error on the read side of the handshake, where ERR_BLOCK is folded into -1. It is reachable for a wss:// client, whose master channel is then a TLS channel: a wakeup carrying only part of a record makes gnutls report EAGAIN. The series applies to the branch unchanged, and the new unit test passes on it. Upstream posting, reviewed by the graphics maintainer: https://lore.kernel.org/qemu-devel/20260831100151.914178-1-den@openvz.org/ Signed-off-by: Denis V. Lunev Denis V. Lunev (6): io/channel-socket: do not treat a zero length write as an error #VSTOR-143316 io/channel-websock: send an HTTP 400 when the greeting has no space #VSTOR-143316 io/channel-websock: handle a blocked write during the handshake #VSTOR-143316 tests/unit: add websock handshake test #VSTOR-143316 io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading #VSTOR-143316 tests/unit: cover blocked IO during the websock handshake #VSTOR-143316 io/channel-socket.c | 2 +- io/channel-websock.c | 10 +- tests/unit/meson.build | 1 + tests/unit/test-io-channel-websock.c | 249 +++++++++++++++++++++++++++ 4 files changed, 260 insertions(+), 2 deletions(-) create mode 100644 tests/unit/test-io-channel-websock.c -- 2.53.0