On Mon, Aug 31, 2026 at 12:01:46PM +0200, Denis V. Lunev wrote: > From: Denis V. Lunev <[email protected]> > > qio_channel_socket_writev() checks "ret <= 0" after sendmsg(). A zero > length iovec is written successfully and returns 0, so the success > falls into the errno switch, which acts on whatever the last failing > syscall left in errno. A stale EAGAIN turns it into > QIO_CHANNEL_ERR_BLOCK with errp untouched, and a caller which treats > every negative return as fatal then passes a NULL Error to > error_get_pretty(). The websocket handshake does exactly that, so an > unauthenticated client crashes QEMU during the greeting. > > Returning 0 is safe for callers which loop until everything is > written. qio_channel_writev_full_all() has no zero progress guard, but > iov_copy() yields no entries for a zero length write, so that loop is > never entered. A connected stream socket returns 0 only when there is > nothing to send. > > The WIN32 implementation in the same file uses "ret < 0". > > Fixes: 559607ea173a ("io: add QIOChannelSocket class") > Cc: [email protected] > Cc: Daniel P. Berrangé <[email protected]> > Cc: Marc-André Lureau <[email protected]> > Signed-off-by: Denis V. Lunev <[email protected]> > --- > io/channel-socket.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Daniel P. Berrangé <[email protected]> Though IMHO it is also a bug in the caller to request writing of zero bytes. With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
