Re: [PATCH hci-8.0 0/6] io/channel-websock: fix an unauthenticated crash in the handshake #VSTOR-143316

[Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>]

Ack
Applied to hci-8.0

On 8/31/26 5:06 PM, Denis V. Lunev wrote:
> Backport of the upstream series fixing an unauthenticated crash in the
> VNC websocket handshake. A client which can reach a websocket port
> crashes QEMU before it has authenticated, by sending an HTTP greeting
> whose request line holds no space:
> 
>   printf 'stats\r\nx\r\n\r\n' | nc $host $port
> 
> Three defects line up to produce it. The greeting is rejected without
> queueing a response, so the handshake goes on to flush an empty buffer.
> A zero length sendmsg() succeeds and returns 0, which
> qio_channel_socket_writev() mistakes for failure and reports as
> QIO_CHANNEL_ERR_BLOCK with errp left unset. The handshake treats every
> negative return as fatal and hands that NULL Error to
> error_get_pretty(). Patches 1 to 3 close the three links.
> 
> Patch 5 is the same NULL Error on the read side of the handshake, where
> ERR_BLOCK is folded into -1. It is reachable for a wss:// client, whose
> master channel is then a TLS channel: a wakeup carrying only part of a
> record makes gnutls report EAGAIN.
> 
> The series applies to the branch unchanged, and the new unit test passes
> on it.
> 
> Upstream posting, reviewed by the graphics maintainer:
> https://lore.kernel.org/qemu-devel/20260831100151.914178-1-den@openvz.org/
> 
> Signed-off-by: Denis V. Lunev <den@openvz.org>
> 
> Denis V. Lunev (6):
>   io/channel-socket: do not treat a zero length write as an error
>     #VSTOR-143316
>   io/channel-websock: send an HTTP 400 when the greeting has no space
>     #VSTOR-143316
>   io/channel-websock: handle a blocked write during the handshake
>     #VSTOR-143316
>   tests/unit: add websock handshake test #VSTOR-143316
>   io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading
>     #VSTOR-143316
>   tests/unit: cover blocked IO during the websock handshake
>     #VSTOR-143316
> 
>  io/channel-socket.c                  |   2 +-
>  io/channel-websock.c                 |  10 +-
>  tests/unit/meson.build               |   1 +
>  tests/unit/test-io-channel-websock.c | 249 +++++++++++++++++++++++++++
>  4 files changed, 260 insertions(+), 2 deletions(-)
>  create mode 100644 tests/unit/test-io-channel-websock.c
>