static int nbd_co_receive_request(NBDRequestData *req, NBDRequest *request,

                                  Error **errp)

{

    NBDClient *client = req->client;

    int valid_flags;



    g_assert(qemu_in_coroutine());

    assert(client->recv_coroutine == qemu_coroutine_self());

    if (nbd_receive_request(client->ioc, request, errp) < 0) {

        return -EIO;

    }



    trace_nbd_co_receive_request_decode_type(request->handle, request->type,

                                             nbd_cmd_lookup(request->type));



    if (request->type != NBD_CMD_WRITE) {

        /* No payload, we are ready to read the next request.  */

        req->complete = true;

    }



    if (request->type == NBD_CMD_DISC) {

        /* Special case: we're going to disconnect without a reply,

         * whether or not flags, from, or len are bogus */

        return -EIO;

    }



    /* Check for sanity in the parameters, part 1.  Defer as many

     * checks as possible until after reading any NBD_CMD_WRITE

     * payload, so we can try and keep the connection alive.  */

    if ((request->from + request->len) < request->from) {

        error_setg(errp,

                   "integer overflow detected, you're probably being attacked");

        return -EINVAL;

    }



    if (request->type == NBD_CMD_READ || request->type == NBD_CMD_WRITE) {

        if (request->len > NBD_MAX_BUFFER_SIZE) {

            error_setg(errp, "len (%" PRIu32" ) is larger than max len (%u)",

                       request->len, NBD_MAX_BUFFER_SIZE);

            return -EINVAL;

        }



        req->data = blk_try_blockalign(client->exp->blk, request->len);

        if (req->data == NULL) {

            error_setg(errp, "No memory");

            return -ENOMEM;

        }

    }

    if (request->type == NBD_CMD_WRITE) {

        if (nbd_read(client->ioc, req->data, request->len, errp) < 0) {

            error_prepend(errp, "reading from socket failed: ");

            return -EIO;

        }

        req->complete = true;



        trace_nbd_co_receive_request_payload_received(request->handle,

                                                      request->len);

    }



    /* Sanity checks, part 2. */

    if (request->from + request->len > client->exp->size) {

        error_setg(errp, "operation past EOF; From: %" PRIu64 ", Len: %" PRIu32

                   ", Size: %" PRIu64, request->from, request->len,

                   (uint64_t)client->exp->size);

        return request->type == NBD_CMD_WRITE ? -ENOSPC : -EINVAL;

    }

    valid_flags = NBD_CMD_FLAG_FUA;

    if (request->type == NBD_CMD_READ && client->structured_reply) {

        valid_flags |= NBD_CMD_FLAG_DF;

    } else if (request->type == NBD_CMD_WRITE_ZEROES) {

        valid_flags |= NBD_CMD_FLAG_NO_HOLE;

    }

    if (request->flags & ~valid_flags) {

        error_setg(errp, "unsupported flags for command %s (got 0x%x)",

                   nbd_cmd_lookup(request->type), request->flags);

        return -EINVAL;

    }



    return 0;

}

static int nbd_co_receive_request(NBDRequestData *req, NBDRequest *request,

                                  Error **errp)

{

    NBDClient *client = req->client;

    int valid_flags;



    g_assert(qemu_in_coroutine());

    assert(client->recv_coroutine == qemu_coroutine_self());

    if (nbd_receive_request(client->ioc, request, errp) < 0) {

        return -EIO;

    }



    trace_nbd_co_receive_request_decode_type(request->handle, request->type,

                                             nbd_cmd_lookup(request->type));



    if (request->type != NBD_CMD_WRITE) {

        

        req->complete = true;

    }



    if (request->type == NBD_CMD_DISC) {

        



        return -EIO;

    }



    





    if ((request->from + request->len) < request->from) {

        error_setg(errp,

                   "integer overflow detected, you're probably being attacked");

        return -EINVAL;

    }



    if (request->type == NBD_CMD_READ || request->type == NBD_CMD_WRITE) {

        if (request->len > NBD_MAX_BUFFER_SIZE) {

            error_setg(errp, "len (%" PRIu32" ) is larger than max len (%u)",

                       request->len, NBD_MAX_BUFFER_SIZE);

            return -EINVAL;

        }



        req->data = blk_try_blockalign(client->exp->blk, request->len);

        if (req->data == NULL) {

            error_setg(errp, "No memory");

            return -ENOMEM;

        }

    }

    if (request->type == NBD_CMD_WRITE) {

        if (nbd_read(client->ioc, req->data, request->len, errp) < 0) {

            error_prepend(errp, "reading from socket failed: ");

            return -EIO;

        }

        req->complete = true;



        trace_nbd_co_receive_request_payload_received(request->handle,

                                                      request->len);

    }



    

    if (request->from + request->len > client->exp->size) {

        error_setg(errp, "operation past EOF; From: %" PRIu64 ", Len: %" PRIu32

                   ", Size: %" PRIu64, request->from, request->len,

                   (uint64_t)client->exp->size);

        return request->type == NBD_CMD_WRITE ? -ENOSPC : -EINVAL;

    }

    valid_flags = NBD_CMD_FLAG_FUA;

    if (request->type == NBD_CMD_READ && client->structured_reply) {

        valid_flags |= NBD_CMD_FLAG_DF;

    } else if (request->type == NBD_CMD_WRITE_ZEROES) {

        valid_flags |= NBD_CMD_FLAG_NO_HOLE;

    }

    if (request->flags & ~valid_flags) {

        error_setg(errp, "unsupported flags for command %s (got 0x%x)",

                   nbd_cmd_lookup(request->type), request->flags);

        return -EINVAL;

    }



    return 0;

}

    if ((request->from + request->len) < request->from) {         error_setg(errp,                    "integer overflow detected, you're probably being attacked");         return -EINVAL;     if (request->from + request->len > client->exp->size) {         return request->type == NBD_CMD_WRITE ? -ENOSPC : -EINVAL;
static int FUNC_0(NBDRequestData *VAR_0, NBDRequest *VAR_1,

                                  Error **VAR_2)

{

    NBDClient *client = VAR_0->client;

    int VAR_3;



    g_assert(qemu_in_coroutine());

    assert(client->recv_coroutine == qemu_coroutine_self());

    if (nbd_receive_request(client->ioc, VAR_1, VAR_2) < 0) {

        return -EIO;

    }



    trace_nbd_co_receive_request_decode_type(VAR_1->handle, VAR_1->type,

                                             nbd_cmd_lookup(VAR_1->type));



    if (VAR_1->type != NBD_CMD_WRITE) {

        

        VAR_0->complete = true;

    }



    if (VAR_1->type == NBD_CMD_DISC) {

        



        return -EIO;

    }



    





    if ((VAR_1->from + VAR_1->len) < VAR_1->from) {

        error_setg(VAR_2,

                   "integer overflow detected, you're probably being attacked");

        return -EINVAL;

    }



    if (VAR_1->type == NBD_CMD_READ || VAR_1->type == NBD_CMD_WRITE) {

        if (VAR_1->len > NBD_MAX_BUFFER_SIZE) {

            error_setg(VAR_2, "len (%" PRIu32" ) is larger than max len (%u)",

                       VAR_1->len, NBD_MAX_BUFFER_SIZE);

            return -EINVAL;

        }



        VAR_0->data = blk_try_blockalign(client->exp->blk, VAR_1->len);

        if (VAR_0->data == NULL) {

            error_setg(VAR_2, "No memory");

            return -ENOMEM;

        }

    }

    if (VAR_1->type == NBD_CMD_WRITE) {

        if (nbd_read(client->ioc, VAR_0->data, VAR_1->len, VAR_2) < 0) {

            error_prepend(VAR_2, "reading from socket failed: ");

            return -EIO;

        }

        VAR_0->complete = true;



        trace_nbd_co_receive_request_payload_received(VAR_1->handle,

                                                      VAR_1->len);

    }



    

    if (VAR_1->from + VAR_1->len > client->exp->size) {

        error_setg(VAR_2, "operation past EOF; From: %" PRIu64 ", Len: %" PRIu32

                   ", Size: %" PRIu64, VAR_1->from, VAR_1->len,

                   (uint64_t)client->exp->size);

        return VAR_1->type == NBD_CMD_WRITE ? -ENOSPC : -EINVAL;

    }

    VAR_3 = NBD_CMD_FLAG_FUA;

    if (VAR_1->type == NBD_CMD_READ && client->structured_reply) {

        VAR_3 |= NBD_CMD_FLAG_DF;

    } else if (VAR_1->type == NBD_CMD_WRITE_ZEROES) {

        VAR_3 |= NBD_CMD_FLAG_NO_HOLE;

    }

    if (VAR_1->flags & ~VAR_3) {

        error_setg(VAR_2, "unsupported flags for command %s (got 0x%x)",

                   nbd_cmd_lookup(VAR_1->type), VAR_1->flags);

        return -EINVAL;

    }



    return 0;

}

static int FUNC_0(NBDRequestData *VAR_0, NBDRequest *VAR_1,
Error **VAR_2)
{ NBDClient *client = VAR_0->client; int VAR_3; g_assert(qemu_in_coroutine()); assert(client->recv_coroutine == qemu_coroutine_self()); if (nbd_receive_request(client->ioc, VAR_1, VAR_2) < 0) { return -EIO; } trace_nbd_co_receive_request_decode_type(VAR_1->handle, VAR_1->type,
nbd_cmd_lookup(VAR_1->type)); if (VAR_1->type != NBD_CMD_WRITE) { VAR_0->complete = true; } if (VAR_1->type == NBD_CMD_DISC) { return -EIO; } if ((VAR_1->from + VAR_1->len) < VAR_1->from) { error_setg(VAR_2,
"integer overflow detected, you're probably being attacked"); return -EINVAL; } if (VAR_1->type == NBD_CMD_READ || VAR_1->type == NBD_CMD_WRITE) { if (VAR_1->len > NBD_MAX_BUFFER_SIZE) { error_setg(VAR_2, "len (%" PRIu32" ) is larger than max len (%u)",
VAR_1->len, NBD_MAX_BUFFER_SIZE); return -EINVAL; } VAR_0->data = blk_try_blockalign(client->exp->blk, VAR_1->len); if (VAR_0->data == NULL) { error_setg(VAR_2, "No memory"); return -ENOMEM; } } if (VAR_1->type == NBD_CMD_WRITE) { if (nbd_read(client->ioc, VAR_0->data, VAR_1->len, VAR_2) < 0) { error_prepend(VAR_2, "reading from socket failed: "); return -EIO; } VAR_0->complete = true; trace_nbd_co_receive_request_payload_received(VAR_1->handle,
VAR_1->len); } if (VAR_1->from + VAR_1->len > client->exp->size) { error_setg(VAR_2, "operation past EOF; From: %" PRIu64 ", Len: %" PRIu32 ", Size: %" PRIu64, VAR_1->from, VAR_1->len,
(uint64_t)client->exp->size); return VAR_1->type == NBD_CMD_WRITE ? -ENOSPC : -EINVAL; } VAR_3 = NBD_CMD_FLAG_FUA; if (VAR_1->type == NBD_CMD_READ && client->structured_reply) { VAR_3 |= NBD_CMD_FLAG_DF; } else if (VAR_1->type == NBD_CMD_WRITE_ZEROES) { VAR_3 |= NBD_CMD_FLAG_NO_HOLE; } if (VAR_1->flags & ~VAR_3) { error_setg(VAR_2, "unsupported flags for command %s (got 0x%x)",
nbd_cmd_lookup(VAR_1->type), VAR_1->flags); return -EINVAL; } return 0; }