From: Christian Pötzsch Date: Fri, 26 Apr 2024 08:33:13 +0000 (+0200) Subject: Fix vhost user assertion when sending more than one fd X-Git-Tag: v9.1.0-rc0~46^2~76 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5093bee0fa8a6c9712c96653da3a79bc37a4e45d;p=thirdparty%2Fqemu.git Fix vhost user assertion when sending more than one fd If the client sends more than one region this assert triggers. The reason is that two fd's are 8 bytes and VHOST_MEMORY_BASELINE_NREGIONS is exactly 8. The assert is wrong because it should not test for the size of the fd array, but for the numbers of regions. Signed-off-by: Christian Pötzsch Message-Id: <20240426083313.3081272-1-christian.poetzsch@kernkonzept.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvhost-user/libvhost-user.c index a879149fefa..8adb277d545 100644 --- a/subprojects/libvhost-user/libvhost-user.c +++ b/subprojects/libvhost-user/libvhost-user.c @@ -568,7 +568,7 @@ vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg) if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) { fd_size = cmsg->cmsg_len - CMSG_LEN(0); vmsg->fd_num = fd_size / sizeof(int); - assert(fd_size < VHOST_MEMORY_BASELINE_NREGIONS); + assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); memcpy(vmsg->fds, CMSG_DATA(cmsg), fd_size); break; }