[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 1/7] 9pfs: restrict open to regular files and direct
From: |
Greg Kurz |
Subject: |
[Qemu-devel] [PATCH 1/7] 9pfs: restrict open to regular files and directories |
Date: |
Tue, 10 Jan 2017 15:32:15 +0100 |
User-agent: |
StGit/0.17.1-20-gc0b1b-dirty |
It really does not make sense for the 9P server to open anything else but
a regular file or a directory.
Malicious code in a guest could for example create a named pipe, associate
it to a valid fid and pass it to the server in a RLOPEN message. This would
cause QEMU to hang in open(), waiting for someone to open the other end of
the pipe.
Signed-off-by: Greg Kurz <address@hidden>
---
hw/9pfs/9p.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index fa58877570f6..edd7b97270e3 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -1462,7 +1462,7 @@ static void coroutine_fn v9fs_open(void *opaque)
goto out;
}
err += offset;
- } else {
+ } else if (S_ISREG(stbuf.st_mode)) {
if (s->proto_version == V9FS_PROTO_2000L) {
flags = get_dotl_openflags(s, mode);
} else {
@@ -1494,6 +1494,9 @@ static void coroutine_fn v9fs_open(void *opaque)
goto out;
}
err += offset;
+ } else {
+ err = -EINVAL;
+ goto out;
}
trace_v9fs_open_return(pdu->tag, pdu->id,
qid.type, qid.version, qid.path, iounit);
- [Qemu-devel] [PATCH 0/7] fix potential hangs in 9pfs, Greg Kurz, 2017/01/10
- [Qemu-devel] [PATCH 1/7] 9pfs: restrict open to regular files and directories,
Greg Kurz <=
- [Qemu-devel] [PATCH 2/7] tests: virtio-9p: improve error reporting, Greg Kurz, 2017/01/10
- [Qemu-devel] [PATCH 3/7] tests: virtio-9p: add LOPEN operation test, Greg Kurz, 2017/01/10
- [Qemu-devel] [PATCH 4/7] tests: virtio-9p: TLOPEN should fail to open a FIFO, Greg Kurz, 2017/01/10
- [Qemu-devel] [PATCH 5/7] 9pfs: don't create files if pathname already exists, Greg Kurz, 2017/01/10
- [Qemu-devel] [PATCH 6/7] tests: virtio-9p: add LCREATE operation test, Greg Kurz, 2017/01/10
- [Qemu-devel] [PATCH 7/7] tests: virtio-9p: TLCREATE should fail if pathname exists, Greg Kurz, 2017/01/10