diff options
| author | Denis V. Lunev <den@openvz.org> | 2026-08-31 12:01:48 +0200 |
|---|---|---|
| committer | Daniel P. Berrangé <berrange@redhat.com> | 2026-09-07 11:31:03 +0100 |
| commit | 2295deb48898f2c466d0a5013cdd35a9d836b1cb (patch) | |
| tree | 60a470863e83542c4606cf9ed09ec1a1a9a25b5a | |
| parent | cd71c2f40a53a569911310aceb21cef55c349d38 (diff) | |
| download | qemu-2295deb48898f2c466d0a5013cdd35a9d836b1cb.tar.gz qemu-2295deb48898f2c466d0a5013cdd35a9d836b1cb.zip | |
io/channel-websock: handle a blocked write during the handshake
qio_channel_websock_handshake_send() treats every negative return from
qio_channel_write() as fatal and passes err to error_get_pretty().
QIO_CHANNEL_ERR_BLOCK is negative but leaves err NULL, so a socket
which cannot take the response immediately crashes QEMU before the
client has authenticated.
Keep the G_IO_OUT watch armed and retry instead.
Fixes: 2d1d0e70cf3e ("io: add QIOChannelWebsock class")
Fixes: CVE-2026-84788
Cc: qemu-stable@nongnu.org
Cc: Daniel P. Berrangé <berrange@redhat.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
| -rw-r--r-- | io/channel-websock.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/io/channel-websock.c b/io/channel-websock.c index 66c91ed2a2..8f27b1f12b 100644 --- a/io/channel-websock.c +++ b/io/channel-websock.c @@ -562,6 +562,11 @@ static gboolean qio_channel_websock_handshake_send(QIOChannel *ioc, wioc->encoutput.offset, &err); + if (ret == QIO_CHANNEL_ERR_BLOCK) { + /* Socket buffer is full, the G_IO_OUT watch stays armed */ + return TRUE; + } + if (ret < 0) { trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err)); qio_task_set_error(task, err); |