[Qemu-devel] Bug#636035: qemu-user: init_paths() doesnt guard against recursive link cycles

[Johannes Schauer]

Package: qemu-user
Version: 0.14.1+dfsg-3
Severity: normal

Hi,

when a symbolic or hardlink which creates a recursive cycle exists in
the directory specified as the elf interpreter prefix
(default=/etc/qemu-binfmt/<arch>/), qemu-user will recursively traverse
this path and never finish (eating tons of memory in the process).

The easiest way to reproduce is to do:

ln -s '.' /etc/qemu-binfmt/<arch>/foobar

(or wherever directory you pointed qemu to with the -L option)

This is mostly annoying because there exists the /usr/bin/X11 symlink
which points to '.' in debian systems with x11-common installed.

Other problems occur with /proc/self/fd/ (and /dev/fd/ which links to
it) when /proc is mounted in the elf interpreter prefix path.

The problem occurs when init_paths() is called on interp_prefix (the elf
interpreter prefix path). init_paths() doesnt protect from infinitely
traversing cyclic symlinks.

find(1) solves this problem by maintaining a hashtable of (to be)
traversed directories and skipping directories that are found to be
already part of it.

I can prepare a patch for path.c (which defines init_paths()) which
guards against this behaviour in the same way that find(1) does if this
problem is desired to be solved that way.

cheers, josch