Fix vhost user assertion when sending more than one fd
authorChristian Pötzsch <christian.poetzsch@kernkonzept.com>
Fri, 26 Apr 2024 08:33:13 +0000 (10:33 +0200)
committerMichael S. Tsirkin <mst@redhat.com>
Mon, 1 Jul 2024 18:56:23 +0000 (14:56 -0400)
If the client sends more than one region this assert triggers. The
reason is that two fd's are 8 bytes and VHOST_MEMORY_BASELINE_NREGIONS
is exactly 8.

The assert is wrong because it should not test for the size of the fd
array, but for the numbers of regions.

Signed-off-by: Christian Pötzsch <christian.poetzsch@kernkonzept.com>
Message-Id: <20240426083313.3081272-1-christian.poetzsch@kernkonzept.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
subprojects/libvhost-user/libvhost-user.c

index a879149fefacca2a1f08551b0dc282e42e17f752..8adb277d545e2962aa7bd31aaf851d5770b7fb57 100644 (file)
@@ -568,7 +568,7 @@ vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg)
         if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) {
             fd_size = cmsg->cmsg_len - CMSG_LEN(0);
             vmsg->fd_num = fd_size / sizeof(int);
-            assert(fd_size < VHOST_MEMORY_BASELINE_NREGIONS);
+            assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS);
             memcpy(vmsg->fds, CMSG_DATA(cmsg), fd_size);
             break;
         }