static int nbd_co_receive_request(NBDRequestData *req, NBDRequest *request,

                                  Error **errp)

{

    NBDClient *client = req->client;

    int valid_flags;



    g_assert(qemu_in_coroutine());

    assert(client->recv_coroutine == qemu_coroutine_self());

    if (nbd_receive_request(client->ioc, request, errp) < 0) {

        return -EIO;

    }



    trace_nbd_co_receive_request_decode_type(request->handle, request->type,

                                             nbd_cmd_lookup(request->type));



    if (request->type != NBD_CMD_WRITE) {

        /* No payload, we are ready to read the next request.  */

        req->complete = true;

    }



    if (request->type == NBD_CMD_DISC) {

        /* Special case: we're going to disconnect without a reply,

         * whether or not flags, from, or len are bogus */

        return -EIO;

    }



    /* Check for sanity in the parameters, part 1.  Defer as many

     * checks as possible until after reading any NBD_CMD_WRITE

     * payload, so we can try and keep the connection alive.  */

    if ((request->from + request->len) < request->from) {

        error_setg(errp,

                   "integer overflow detected, you're probably being attacked");

        return -EINVAL;

    }



    if (request->type == NBD_CMD_READ || request->type == NBD_CMD_WRITE) {

        if (request->len > NBD_MAX_BUFFER_SIZE) {

            error_setg(errp, "len (%" PRIu32" ) is larger than max len (%u)",

                       request->len, NBD_MAX_BUFFER_SIZE);

            return -EINVAL;

        }



        req->data = blk_try_blockalign(client->exp->blk, request->len);

        if (req->data == NULL) {

            error_setg(errp, "No memory");

            return -ENOMEM;

        }

    }

    if (request->type == NBD_CMD_WRITE) {

        if (nbd_read(client->ioc, req->data, request->len, errp) < 0) {

            error_prepend(errp, "reading from socket failed: ");

            return -EIO;

        }

        req->complete = true;



        trace_nbd_co_receive_request_payload_received(request->handle,

                                                      request->len);

    }



    /* Sanity checks, part 2. */

    if (request->from + request->len > client->exp->size) {

        error_setg(errp, "operation past EOF; From: %" PRIu64 ", Len: %" PRIu32

                   ", Size: %" PRIu64, request->from, request->len,

                   (uint64_t)client->exp->size);

        return request->type == NBD_CMD_WRITE ? -ENOSPC : -EINVAL;

    }

    valid_flags = NBD_CMD_FLAG_FUA;

    if (request->type == NBD_CMD_READ && client->structured_reply) {

        valid_flags |= NBD_CMD_FLAG_DF;

    } else if (request->type == NBD_CMD_WRITE_ZEROES) {

        valid_flags |= NBD_CMD_FLAG_NO_HOLE;

    }

    if (request->flags & ~valid_flags) {

        error_setg(errp, "unsupported flags for command %s (got 0x%x)",

                   nbd_cmd_lookup(request->type), request->flags);

        return -EINVAL;

    }



    return 0;

}
