From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from PA6PR08MB10813.eurprd08.prod.outlook.com (2603:10a6:102:3d3::16) by PAXPR08MB6942.eurprd08.prod.outlook.com with HTTPS; Mon, 31 Aug 2026 14:07:06 +0000 Received: from VI1PR09CA0118.eurprd09.prod.outlook.com (2603:10a6:803:78::41) by PA6PR08MB10813.eurprd08.prod.outlook.com (2603:10a6:102:3d3::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Mon, 31 Aug 2026 14:07:01 +0000 Received: from WA1PEPF000099CD.eurprd04.prod.outlook.com (2603:10a6:803:78:cafe::a6) by VI1PR09CA0118.outlook.office365.com (2603:10a6:803:78::41) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Mon, 31 Aug 2026 14:06:54 +0000 Authentication-Results: spf=softfail (sender IP is 99.81.216.78) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning openvz.org discourages use of 99.81.216.78 as permitted sender) Received: from nat.eu.perception-point.io (99.81.216.78) by WA1PEPF000099CD.mail.protection.outlook.com (10.167.242.21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.8 via Frontend Transport; Mon, 31 Aug 2026 14:06:52 +0000 X-PERCEPTION-POINT-VERDICT: CLN X-PERCEPTION-POINT-SPF: X-PERCEPTION-POINT-SPAM: PASS X-PERCEPTION-POINT-SENDER-IP: 2a00:1450:4864:20::331 X-PP-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::331;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x331.google.com;PTR:mail-wm1-x331.google.com;CAT:NONE;SFS:(13230040)(704160211799003)(3072899012)(2092899012)(43022699015)(6059299003)(12012899012)(82310400026)(5063699009)(10067099003)(19002099009)(18002099003)(16102099003)(57112099003)(55112099003)(13003099007);DIR:INB; Received: from AM0PR07CU002.outbound.protection.outlook.com (mail-am0pr07cu00200.outbound.protection.outlook.com [40.93.65.64]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id 6rfvrpqeo29proj6gsu6j4oelh6t21n92cf8tc01; Mon, 31 Aug 2026 14:06:49 +0000 (UTC) X-SES-Spam-Verdict: PASS X-SES-Virus-Verdict: PASS Received-SPF: softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.65.64 as permitted sender) client-ip=40.93.65.64; envelope-from=den@openvz.org; helo=AM0PR07CU002.outbound.protection.outlook.com; Authentication-Results-Original: amazonses.com; spf=softfail (spfCheck: transitioning domain of openvz.org does not designate 40.93.65.64 as permitted sender) client-ip=40.93.65.64; envelope-from=den@openvz.org; helo=AM0PR07CU002.outbound.protection.outlook.com; dkim=pass header.i=@openvz.org; dmarc=pass header.from=openvz.org; X-SES-RECEIPT: AEFBQUFBQUFBQUFHS25sWThkRnF3a2twMjFsV1JxWjQwSWVqK1ZOUmNHa2pOemJJaGVhR09WVUhhait6eFF0SXpRTFNwaGNlcG5XQnN3b1ltVzN2MU1zTTNEL25NMURCd01Bd1JUV0Nua20rMTROWnBWOXF6NjNNWktjTGZkcEpOVnpxTlBLV0Q2MktncU5zUkJNb010Yk1zNExQY0VCQkNHQkZvY1pmbFdEQTA4ODJMT2IvcmJHU0NUWlZmYkQwRzBiS3RCQWZOVExsR1hUcUY4SEJOWXBZOWpnd0xsYnNkZGkrbVNjbE83bTVMeUxFZlNXQU8yTlZEV3crM3VRQWxMWlI5UGRsSXRzTkg2VnpvY2lpOTNwcGF2UzBqQ1ErOFBMaENIVVdYWHN0a2F5NVF2UERuNEE9PQ== X-SES-DKIM-SIGNATURE: a=rsa-sha256; q=dns/txt; b=LfdO3pLmjl3Alxd4DamzTbgJKPfv3WQWXrGSadmKANsjmK+F6qo1cra7CPlIMsh3Kp/ifLWf0WUhFNLTodhVwCOo/n4HhQTum6Bv16MwIgU2VGzU0YHgig5yxH6GQmiK3ikk/aCamaY0rnLFeuI1qiCEuJQBuxmfTSnQndvSVAk=; c=relaxed/simple; s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1788185209; v=1; bh=Hdim0pj6zfRHOa/PfzM2OkI/9WQzAi4EqZUUxUBHc8w=; h=From:To:Cc:Bcc:Subject:Date:Message-ID:MIME-Version:Content-Type:X-SES-RECEIPT; Received: from DUZP191CA0069.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:4fa::22) by DBAPR08MB5816.eurprd08.prod.outlook.com (2603:10a6:10:1b3::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Mon, 31 Aug 2026 14:06:43 +0000 Received: from DU2PEPF00028CFE.eurprd03.prod.outlook.com (2603:10a6:10:4fa:cafe::52) by DUZP191CA0069.outlook.office365.com (2603:10a6:10:4fa::22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.13 via Frontend Transport; Mon, 31 Aug 2026 14:06:43 +0000 Authentication-Results-Original: spf=pass (sender IP is 2a00:1450:4864:20::331) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::331 as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::331; helo=mail-wm1-x331.google.com; pr=C Received: from mail-wm1-x331.google.com (2a00:1450:4864:20::331) by DU2PEPF00028CFE.mail.protection.outlook.com (2603:10a6:18:3::6b6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.3 via Frontend Transport; Mon, 31 Aug 2026 14:06:41 +0000 Received: by mail-wm1-x331.google.com with SMTP id 5b1f17b1804b1-49b9320423cso34873665e9.0 for ; Mon, 31 Aug 2026 07:06:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1788185201; x=1788790001; darn=virtuozzo.com; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=imnVmJ6RNDMpE/buP+CiNwcurABbnXbw3e/h6YdVFik=; b=nAeq6uPxMaeZ3DNrNEqOp0LceqadxD3xGlWfXi7uHsLEiQpIDS3Qd5RFm4FN4y7F1K G9y+zKoouD1lZIjFKzUPvrtp8+UFt4DNZ518cb0odRyK/GqtPc0dPxnmy0MIHl1dNTTY fg5hfOsqtA9POC9rahWUMbr0hQtVlr8BXI0PXJ9wcNo/0AmoVSoRSr73CS8P5FnBXxtd dkywC6dQPNAcLnyQyjkX9giQhviuC+HsJ4Js7bRUEduYkoDoze4Dqo0N7bCSfc3aYCU+ y/Lo09HshDgDi1vI3sQhZ1YB63WvGK8QHb5ItwStRYdcKrttDYqHJAl4U3c+DJSv47g9 aRfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788185201; x=1788790001; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=imnVmJ6RNDMpE/buP+CiNwcurABbnXbw3e/h6YdVFik=; b=HjMJITxEwRQs/5fU0LAoMq0jp1rU8ceO5XeP0o2n132Bnn1x2sSraPS+n2IUYlhZ7p ArVGgZfhOj4IdH+u9YuExpJ+Kvo9PXEfyG4xtL6IGCnrPOkrsaYiVCUlgClpVQjkfOx4 8aFlY/c+Uw9wzOCH9g1DT+Ob+ljC05P8kua7oPibtv031bUsIhoz3JwqpdggB3oWf/2j XfmeACeh0UwCJwylB3h1NyeckaWSteP6kaU+mDp7NZZ/xsHZ1tlltI49HzKjztPGKjJe Cvml175eeI0ANoX8574f5tzyc3IqNaOIYxpnSXppdaW11yMdeGJslnHHL6jOxV7PKD3C vyjQ== X-Gm-Message-State: AFuF++mB7fVnX78+q8c0JB0faEs+aoObsd4sgRCS0Pziad0NCo+H61ii BW2kQHK8UEz9zwx47byDcUvmP2jNjqPy3UWepGYmgQwdyA5Yn+yV1Ani1jyXrs+wa2JwLRZ1Ewk IfTRh50Y= X-Gm-Gg: AR+sD13mk0KKFSyD8RLOcSLZOheFmB6l/jhJEprOiZJfsr4FwTEveToCdA7AIzPJKu5 +hkqhAKxxYouMdWBPndUWDYXwZ8BEJxYDO/oWSz8ehyG7nKAkS5RTuI88UHh2mTUPbkKex+E0t/ wNrfgJ8X74YmCmURvm0WF9ulZQsbXU+9cdaWtX82V9lBsbTjP3MR7abPLPoFb9TEqjWOCoUu3DI TXf54bJlF8rSoAKoKQyPMcpDAHMjX8hhtGZ1egT1rUppBTg72pxIi+uKKyMHEtQmteThLMXWQMC bdo5IoLGvRJPvWWPN5go/MZ32jbj1LsP+GStJNoE5EnB3GDvPu74gkNPH/EsP2yEIqOhzStQoiI kZ8nH8/YimPO47q3MWyfAd5yEBTyEsum901/ZU7gRSEguUOJoOf9Pu3UkrNmCgHtwXQj06xMnbo b7ZPpRfm7B1x8l6cw/uuBUdD+1kMG/9IERck8rpvaORT58i/lwibYx3Jwd X-Received: by 2002:a05:600c:8011:b0:496:bbce:fc with SMTP id 5b1f17b1804b1-49cdc5660bamr15895275e9.12.1788185201298; Mon, 31 Aug 2026 07:06:41 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:3bc1:c53b:30b:203e]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49cd2fa779esm133185495e9.2.2026.08.31.07.06.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 31 Aug 2026 07:06:40 -0700 (PDT) From: "Denis V. Lunev" To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.1 0/6] io/channel-websock: fix an unauthenticated crash in the handshake #VSTOR-143316 Date: Mon, 31 Aug 2026 16:06:31 +0200 Message-ID: <20260831140637.1204714-1-den@openvz.org> X-Mailer: git-send-email 2.53.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 1 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:1 X-MS-TrafficTypeDiagnostic: DU2PEPF00028CFE:EE_|DBAPR08MB5816:EE_|WA1PEPF000099CD:EE_|PA6PR08MB10813:EE_|PAXPR08MB6942:EE_ X-MS-Office365-Filtering-Correlation-Id: f4c3ec50-512d-4468-8a64-08df07691bef X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA|SL X-PERCEPTION-POINT-CUSTOM: vzpp X-Microsoft-Antispam-Untrusted: BCL:0;ARA:13230040|704160211799003|3072899012|2092899012|43022699015|6059299003|12012899012|82310400026|5063699009|10067099003|19002099009|18002099003|16102099003|57112099003|55112099003|13003099007; X-Microsoft-Antispam-Message-Info-Original: =?utf-8?B?TlcxamxzUXgrRkpBU0JZRWpRYk5LODQrY2ozeWcyR2wwRmNGMVJBNHE0Unpw?= =?utf-8?B?YjFCWEFjN0NUZ3NiZVBDZTBWNjBjWDQ0V05lOFZNOUYwcnMyRkxLQWlwYnY2?= =?utf-8?B?eGlhL3ovZXlIaVIweDhHb1VRYllRZ2Q0U3ZyR1JIblRiV3hHWGhBMGNkSWl3?= =?utf-8?B?YVNrSnk0RFlKNjRVOGpoeVJOaWNjaDd4MnpWclNaZk5qWlFoUkxKUjFaRSs5?= =?utf-8?B?ZnA1YWJIbStOeDFrVStpd2lCVlJxRDFDWDlST1liM1ZLREdNVE80KzE2UHYy?= =?utf-8?B?dnNzMmw1TTdvcWhXTGxwOHQxaHN0clQyTjhHV1hxY3MwSzV1eVZZZTk2WmdT?= =?utf-8?B?dTFxMlArNE5MWFp0UzlPRFFqaWZucmJmYUhUWUp6SEk2eU9Pa1dmZ2FHYk9R?= =?utf-8?B?RXFucGovWWNJWnZjVEwrc0FVaGlNeWsvdmJIbkJOZHlMMGE2VndqNUM1Y242?= =?utf-8?B?VTMyY2EybGtuZDVlNHUzOXZ0MEEybU5QK242TnA1VklWUVBKTml4ZDhRb1Ix?= =?utf-8?B?SktFdHBrbzhQNEEvQWUvdXo4ekJJSVlpdUJnd3RjalVyc1A2anVMQmZyUnk1?= =?utf-8?B?UlphOHNXZzFWVWs3ZVlUVmZReDRYK1gydWprQzNBZG03TkFOM2tIckk1V2FW?= =?utf-8?B?b283cVhGdk9qamZ5UFdUVWtBTEI0RDlRWHZkMTNYdlp3Q0xqRUk0TWtGeE5J?= =?utf-8?B?Y3pIS29LUWcxbDNtN2I3VmhlcTRVWXJZOFFhRTA5S0gySmxQYUxITThhZUxY?= =?utf-8?B?L1M5VGp4am8xMXp2Q29wZTI2TUFiRVYwdWZOVkVENEE2a0dWY2ZrUU1WT0hj?= =?utf-8?B?QlVkNlZVR1d4MDcrRmovek03SjdJRCtPbk9Ta09PQmxTWkMya2xpTExPSXF3?= =?utf-8?B?enBITDB2SC9wcDlvRndlTzNmdEFDdEl1d1E2aWx4bEVjcjFLWHFmRU9Xb2t3?= =?utf-8?B?QnEvSHlRN3JEZThtbHRjZEo2K1VURjdES2VYejVtVGR6bWNSQ2VycGJDOXJl?= =?utf-8?B?ajZDNjIrdHo3YTZUNlJ2UEoxWWhXK0xleGlRNnYvcDZUbTB6WXB2cENiVjQ3?= =?utf-8?B?SExtZHhjNGpKRHh2TGxqZUJyOHFFVXdXajBFVnhIMWF1b3ZCQ2c4SFVFTlhm?= =?utf-8?B?RlFWczNzK0ZZZUEvUE5VdzcydHkzN1Z4K1h4aXNyMHFoTUh0ZENOWXVjWFU4?= =?utf-8?B?ZmJyY28yOG96TS80akdwRDNMWUNiSDFmenlyM1gzTHBVVzZVeDNlZndXSGZ2?= =?utf-8?B?azFudTFQOVBPQnNMYTMzcm83cGdLdVk0TEt2TkpWUXRmeCtoN3VUNWRhQ0tF?= =?utf-8?B?b2xxT0k2NVZ3eWZVckorcHg0ZjNNQVk4R3BXVDNMYTgxNmJVVXMya0F1cThQ?= =?utf-8?B?T0hhakI5bjY5a0Rra083YXduM0RMczJzcndNK0l3THdvMmxCQXAzUSs4QW0y?= =?utf-8?B?SGFQUEc2VFVSQU9hSXhoSzlUdm1YK3Q2SE1KdWtoM2ZzTlhCdmlxVjBkYUl1?= =?utf-8?B?aFIwUkllS0lsNmc0a1lWVEdKenpiOW9XSnlpeVU3SnFRUzlNRjFsZmpmeXpl?= =?utf-8?B?SUtzaFNMVUZ4QUZ5NXl3d1RzbTdWQXJlbVR3RDRBSjVHT21PR2VlS1luZlkv?= =?utf-8?B?VXExaHhncklRRUJtdHA1U0grUnV1U1JmVERoR0xPemtrZVYwdDJSYzRaTGxr?= =?utf-8?B?VWxjUUh1cWdHaTNuNGdvejYvWmZOa0J6a2lTZXRLUUhFN2dyRWozaFQ4MXVP?= =?utf-8?B?bHhySUxNbEwwQkRKK1E0TkVNL2FwN3hYSXFlNC9wWUNxWlFxTVFFZDVQKy8x?= =?utf-8?B?QTJkY1htNnNTemh3MlFYVnNQeUY3VTM0NHJLQTYyWHpIbkEyRGx5aE45Rzl0?= =?utf-8?B?WWgydlJuUVJtUWFQYXpmMWFSRklYcURNWjc4aDFCNlRMcUZCRWs1Rmc0Q3NU?= =?utf-8?B?bUx3UHhOa1F6dE43NERVb0s0c1lnNE8xbUl5cVUzMXMyaWZvd2VtZ3FDbmFw?= =?utf-8?B?eHdwbWl3UWpvVkRsMzkxQkk5QjRjUGNGenEzSFFUY1VCR1dFS2VDalQ4bUxJ?= =?utf-8?B?dllEUUlvMmFLYzdtb3BRZjVGOEpvKyt0S1VYWTBwakNvL1NVczlqcVowSDVJ?= =?utf-8?B?cmdDL1JmTHhwdUdlNFllUzhLUnI2VjhudmpQbytjb3NlY1RRSERpOXgrL08w?= =?utf-8?B?VHlsdWhnRjl6cDFzZDZ3NUVUTTRWQkFxN0dUaUFHSG1iT1pGaDN2UTNYQ2da?= =?utf-8?B?cGovc1FZSDltczFBNHFLb3BXTVcvNWo5V0VGWGVFQXJzeUIyNGFpUEtaWnhV?= =?utf-8?B?bnZhR0lTVnNGb0ZtZ3lUTndXOHpQTUt0VWN3YWlSY3hLem05OUFVU3o4eUo3?= =?utf-8?B?RVUxRGZIRTJ4RGJPMGQ2Y3JMQTFiS3hTVW9tRmFPT0ZsZFZISG1XOHlZdEJj?= =?utf-8?B?SGd6eWZzMTU0bGhRV1JVWTlsN01NT1ZsK3orTXpERUoxNkt2K05qdDJVcnNx?= =?utf-8?B?OVBQZnB5SnI4VzF0dGJzT0tYeVU0RlRyWE9mMEJzc1duMmxTZTNlMjF0cExu?= =?utf-8?B?NjVsc1o3UW1BMktXZzlmK1F3MWpkQjdNUVgrSjEyT0FoUEJjYkhHdkdkYTVj?= =?utf-8?B?TlVMMGQxZENCd3ExN1ZIV3FpRGVhT1ZCc3N2VTU0aWFwUnRyNzFjeXk1UnRs?= =?utf-8?B?cHpRSmIrQW5kT0R3aVI4dEZnaXVZa2cydWs0RkFLRzgyU2VDSjhudHR1citO?= =?utf-8?B?eUgwNjEvWjEvTllLZnFZOFZzY2RERFhhQUNYZmxnQkppeUNWNnRlckZ1ZEpq?= =?utf-8?Q?g7c2uSGp2YjF0smXuQ01c=3D?= X-Forefront-Antispam-Report-Untrusted: CIP:2a00:1450:4864:20::331;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x331.google.com;PTR:mail-wm1-x331.google.com;CAT:NONE;SFS:(13230040)(704160211799003)(3072899012)(2092899012)(43022699015)(6059299003)(12012899012)(82310400026)(5063699009)(10067099003)(19002099009)(18002099003)(16102099003)(57112099003)(55112099003)(13003099007);DIR:INB; X-Auto-Response-Suppress: DR, OOF, AutoReply X-Exchange-RoutingPolicyChecked: o4UdjSwcrx+rcTtYZqhstj5LXaWpCHDcGGmKwfmPSR9G7aUqfbkZMIBFEwyfCh3HibqI3cc3sKW0cSAZaSVy/lwD+y/vgYSp9r1FWzL74A6DJldn9K4n+wPa/0eZ7qZ2L6kMLalvOAQeg3KsKj2X36Mk2iCNijgBOHJtwxlmsgKRqedmRTuipIhpKoZuXET+kUFicO4uiHWOhb2dSVw+6Sq2mSJl1wVey78cuO9jXAE4nGZcTRPzWeFK4hcD35vjRpkyIeB6kLBuVt7ckq2KNqFkeWWgDjTBI8TfDRRNBDAJuDbHD6GJUjbq3FHI3pHsRHAbpyQYyuxy0yWfPyHbDQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBAPR08MB5816 X-MS-Exchange-Organization-ExpirationStartTime: 31 Aug 2026 14:06:53.1543 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: f4c3ec50-512d-4468-8a64-08df07691bef X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-Exchange-Transport-CrossTenantHeadersStripped: WA1PEPF000099CD.eurprd04.prod.outlook.com X-MS-PublicTrafficType: Email X-MS-Exchange-Organization-AuthSource: WA1PEPF000099CD.eurprd04.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Office365-Filtering-Correlation-Id-Prvs: 3109d256-f123-4d7b-9dc1-08df0769154e X-MS-Exchange-Organization-SCL: -1 X-Microsoft-Antispam: BCL:0;ARA:13230040|704160211799003|35042699022|3072899012|2092899012|6059299003|12012899012|43022699015|82310400026|5063699009|10067099003|19002099009|16102099003|57112099003|55112099003|18003699003|5133699003|13003099007; X-Forefront-Antispam-Report: CIP:99.81.216.78;CTRY:IE;LANG:en;SCL:-1;SRV:;IPV:CAL;SFV:SKN;H:nat.eu.perception-point.io;PTR:nat2.eu.perception-point.io;CAT:NONE;SFS:(13230040)(704160211799003)(35042699022)(3072899012)(2092899012)(6059299003)(12012899012)(43022699015)(82310400026)(5063699009)(10067099003)(19002099009)(16102099003)(57112099003)(55112099003)(18003699003)(5133699003)(13003099007);DIR:INB; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Aug 2026 14:06:52.0367 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f4c3ec50-512d-4468-8a64-08df07691bef X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: WA1PEPF000099CD.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA6PR08MB10813 X-MS-Exchange-Transport-EndToEndLatency: 00:00:14.6282771 X-MS-Exchange-Processed-By-BccFoldering: 15.21.0382.004 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;auth:0;dest:I;ENG:(910005)(944506478)(944626604)(920097)(930201)(20251009189)(140003); X-Microsoft-Antispam-Message-Info: =?utf-8?B?Z09hSFQ3Vkx2OHhmcHpiNzFrS3psYmpMWHpXdHhYQUZEL0RjUWdEQzFSVUkr?= =?utf-8?B?YS9xM29XS2lnSjc0b3JSZ2V6eGJKNWQ1RTdPSUZOVy9XK2JMOEtjZVlIVUJL?= =?utf-8?B?b3pIT1ZXcDVnUFZqNHpmWE4wWUphM00yNVVIOVdJUU52NXNFMzZpZkFjUU8w?= =?utf-8?B?R3VEU2VOUlRZLzdXTXpLWDhaWFpXUVVXdlM1WHVVNkh1NHJRaVh2cWdHa1Vr?= =?utf-8?B?VWNneEFOVnlGNHpkN0I1Y1NxMjN4TnBsSHAvU1VkU3B1clpibjVWaTYycmFY?= =?utf-8?B?eVhGRkdrc1JuL3h5Z3l0Vm9PWWdINU8xUTAveWhuMFFXeHRRd09DUkp5KytY?= =?utf-8?B?OXlvWWpFZVRXZmNsWkJ0ZWV3QUhCREJFOUZMc3dwRmFNL1hWQnRQVjVidlMx?= =?utf-8?B?K2UrdnAvV2o1UFQ3WFZnbWt0UlFYZy9Ja1BpOVRmMHpBZTcrVy91b1cyV1la?= =?utf-8?B?Y0J4ZFlsWXY2OVAxNFZmaHdUdnh1UythazFadVJxbGJoL2xVOFlwbTc0UzNr?= =?utf-8?B?WWhQWERwMGlYeWRteHBWeldOc0tHN05hUVdWa1JxaVlMMmt1ZWREc3J2Ynpv?= =?utf-8?B?T2tVZ254UDlPZmJuVm1FbHU1Z0crbWR3Ry9XSEQ4T2UvZXF0anRoNFdQcGlp?= =?utf-8?B?UVRzVWxMYjM1OUlOWHhxcjYvVDlIUWhnbDFwbWpRNDZIK2dybGNvMjJZL0o5?= =?utf-8?B?ME4wL2NTSytrU0lQRmJWaDk4MUdpLzJFZTVZN3JZeTl5M1NKTi9tdTIvSmw4?= =?utf-8?B?dGZuaCt6akwzK1VCUkxSQ3YrdzJRMG45MWZUZ21VbjVmeUVLYmVWWE1hcmJu?= =?utf-8?B?R2VGOGREQUE5Vk5la0NZMkNjTmZpQllFUHJuWE5XZ0hzN0pYUkJGUWdETW85?= =?utf-8?B?N2NNN0RwdTllcUc5cGMvUk84VmF3U2ZzN210eXVhYjNGVnVNYkdoNFVvMGNS?= =?utf-8?B?UHUxMWNiWllJdGliYTlvY1duTHhwenF2cURVdUZ0UDQ2bWllODkxcFJlNWtW?= =?utf-8?B?YTJIbmJYcFc4djI2enhrYm5qZ2k2ajFDeVBiRnVHZzEwb25qMFJQRzV6Nm9B?= =?utf-8?B?TjZoZG9VQVFDVXNCMDRxMWlBRmxsYjRSVy9xSTR0bWxDYXRjamI4Mnd4R284?= =?utf-8?B?SUFOWHFkY0hhd1lpVHlaTDFjc2hNMmFFbFZRbEdEc3hBYTdWOGRJdWVwd2pE?= =?utf-8?B?Yk5YZ1BiUW9qT09CTGphM05LTktiOC9iRWNVQ3BMdFlTN0t2M0c2b3ltOGZ5?= =?utf-8?B?dDJyOUJsenMvU0NpNWIxeWkxVHZLd3pDN0tLdCtVSTM0c1Y0bVE0VjVTdzgw?= =?utf-8?B?Z3RsNWxpTjhtdk53RnBoT3pVM2VveTF3bVMwOUkwWDI4YmdPUVpVaU1Tc0Z5?= =?utf-8?B?bzMyOTBBbS93ZUVTTTVuVXpWTW9ZTWNTVGJhaTBpMUtuZU9QdzFwajhNekpM?= =?utf-8?B?WkRSWXkxQzUrM1FJblYxRUI1eDFaZDBkT3d4bkc1U256ejNRWXhGdHp1N09J?= =?utf-8?B?OVFkczJBTkk1VFBNSG5Qd2xDL2tQUkRyaVdPU2JJS3NmYzhIT1lXQjJ4SzA3?= =?utf-8?B?alh0U1ZjaUZ2UTdoQTkvS1dWTnRnZllIVWtpdklEMk9CRzFra3RvcWtCek9V?= =?utf-8?B?MHk1VUUzak5vdC9Gbm4wNkdRa1NFWGtBVVIrWVZKSy9DZksxMVdNUjVndWVS?= =?utf-8?B?Y3pBeHNwVVVpL01UaHo0SFBVWVlpVTBYWHljbzVOaEcvTG9XdE9YSkJSWDBr?= =?utf-8?B?cFJjY2RrSnoxWTR1K1BQRDNrY3M4TU9QUERybWtUV0hSem5iQzZKbmI0SHpn?= =?utf-8?B?cGNyWDNHajVlUEVjV1JvdFF6eGh6QVBvUzZiTEV3Q0pKZ2JIclYzWDhvYldZ?= =?utf-8?B?ZEgzd2FTNHgwWUNBcG5STFU3bURxNDViN0FaVmNxN09yTnhMeEJzK3A3VXdD?= =?utf-8?B?VXplVnVCd0dkd0hydHdNYXFGNUxveWpMdi81dXlNaDJ0TDREVndNRzdhQitq?= =?utf-8?B?ZDVYdEhYUi9BeUV0c0RmNTFUb3RKSG85ZU5mRG05OEE5Q0dtRTRrODMyWkpR?= =?utf-8?B?dlk0eC9OakpVdVpTckhFRmJkeDJyVzl5eC9uMDlMOE03NXRzTW5pVElXc1B4?= =?utf-8?B?bE5KM0NCNWxCOVdXRzZGeUh1cTlwRWNSRFIxcWZUVTU0VW5zZWF3NXpSbXlN?= =?utf-8?B?Nm80R081ZlNCeGt0ajA0OXh6REc0aTdHRXVsR1FrUWE2S2ZHejRuVWVoOVlw?= =?utf-8?B?T3J0K3dZa3VXSTVtZ1ZRM2NhZWlnMXB4bjk2SkFiQ0preFFxaWYrQW9sT1Z2?= =?utf-8?B?cXJ4ejM2L2VGNmE1NjFpdkNQR1UxWEphY3ErM29haWU1RlY2ZmVTMmdZZjBr?= =?utf-8?B?QkZRRE9PQmc5MEsrcE5RQTdpRDlUbnNKTTYxNkdpVDFhMzlpei91dzlQajZx?= =?utf-8?B?bS9FT1M0ay9mRmlMVVprUUJ3WW85c20wbzJnZnFXUW10S1RLY0Njc3NHRzBr?= =?utf-8?B?R2FFUU1ZUzBwWjRsZjRBMTJPQVdOdjh5MStIUGk0VmFYZUh1USthQ0tidytF?= =?utf-8?B?OThGZTVKTGlSYklhRGJuMkorbEMraVp5WGUzYWozVzBhSHh0MGt0bElZby9V?= =?utf-8?B?RkdVb3Jrem8xdEJPUUtVMGpUZ0FRdjRscER1b1hBVElXckViVTE4ZmhncWM5?= =?utf-8?B?SDdBbjRqZGNpK3JDeUluaVBWZXJzaVNwK0lMbE83dkhSaHlZNUVLR1RRTXN3?= =?utf-8?B?bzc1ai9KRFkycHRuUUwvb0ZVTGs2aUN3Y0hURThVRGtPa2o0QkkwOHc3Q1VO?= =?utf-8?B?WWpBNXZDbDdlNGRIM01JeFJWcm5JVWV1L0hLUnowWFVWdUlwN0hkQ0ZyMmRp?= =?utf-8?B?OGlvMUVmTS9GdHZrZURabDRia3lRdHJMeWkzVCtNeVcweTNXOHZPSG1VQlIy?= =?utf-8?B?L1ZUeTJaTHlrcmUxeHhnL1FjMGlHam0vWXBpYzVFUXM2cCtkUGlJWktXeEZB?= =?utf-8?B?RXEralV6blN1bWZYRDMySzQ1ZlZ0eUIwbEw3UERyRk90b2tMWHNmQkp1dG85?= =?utf-8?B?M0JZcW41cCtlUC9iTEpaWXR1V1lJV05vK1FlcElKcjljR3hrV0E1RnVNcGN2?= =?utf-8?B?ckJiL1lXdWRVUi9XRkVBNTVQVE02Ri83QlI4NENhMVR1Q1N1cGhQNFU0Kzcy?= =?utf-8?B?MkwrWHArSjZidTRDZldhcjJ4QytGcDZNdGEzMUlLbURJVHo4dWpoZnM1eHNz?= =?utf-8?B?d3NCRFRkN3NJOWFYelIvUEcwUUY2Vk9WVytxeGNJMVVRVE1nTXk3QzM5d3M3?= =?utf-8?B?TE93OEhvOHZLeWZaNWw5ZFZYMXRPUUFsYjdjdzlnRWhqWGFyQVJuMXdXVWtt?= =?utf-8?B?RW9ld2ZvNHZ1bXM3QU44MU1rczRYVzBZbWp6ZE1saytleHpLbFowWDNEdz09?= MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: QEMU List-Id: Backport of the upstream series fixing an unauthenticated crash in the VNC websocket handshake. A client which can reach a websocket port crashes QEMU before it has authenticated, by sending an HTTP greeting whose request line holds no space: printf 'stats\r\nx\r\n\r\n' | nc $host $port Three defects line up to produce it. The greeting is rejected without queueing a response, so the handshake goes on to flush an empty buffer. A zero length sendmsg() succeeds and returns 0, which qio_channel_socket_writev() mistakes for failure and reports as QIO_CHANNEL_ERR_BLOCK with errp left unset. The handshake treats every negative return as fatal and hands that NULL Error to error_get_pretty(). Patches 1 to 3 close the three links. Patch 5 is the same NULL Error on the read side of the handshake, where ERR_BLOCK is folded into -1. It is reachable for a wss:// client, whose master channel is then a TLS channel: a wakeup carrying only part of a record makes gnutls report EAGAIN. The series applies to the branch unchanged, and the new unit test passes on it. Upstream posting, reviewed by the graphics maintainer: https://lore.kernel.org/qemu-devel/20260831100151.914178-1-den@openvz.org/ Signed-off-by: Denis V. Lunev Denis V. Lunev (6): io/channel-socket: do not treat a zero length write as an error #VSTOR-143316 io/channel-websock: send an HTTP 400 when the greeting has no space #VSTOR-143316 io/channel-websock: handle a blocked write during the handshake #VSTOR-143316 tests/unit: add websock handshake test #VSTOR-143316 io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading #VSTOR-143316 tests/unit: cover blocked IO during the websock handshake #VSTOR-143316 io/channel-socket.c | 2 +- io/channel-websock.c | 10 +- tests/unit/meson.build | 1 + tests/unit/test-io-channel-websock.c | 249 +++++++++++++++++++++++++++ 4 files changed, 260 insertions(+), 2 deletions(-) create mode 100644 tests/unit/test-io-channel-websock.c -- 2.53.0