[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 08/25] 9pfs: forbid illegal path names
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 08/25] 9pfs: forbid illegal path names |
Date: |
Tue, 20 Sep 2016 12:05:24 -0500 |
From: Greg Kurz <address@hidden>
Empty path components don't make sense for most commands and may cause
undefined behavior, depending on the backend.
Also, the walk request described in the 9P spec [1] clearly shows that
the client is supposed to send individual path components: the official
linux client never sends portions of path containing the / character for
example.
Moreover, the 9P spec [2] also states that a system can decide to restrict
the set of supported characters used in path components, with an explicit
mention "to remove slashes from name components".
This patch introduces a new name_is_illegal() helper that checks the
names sent by the client are not empty and don't contain unwanted chars.
Since 9pfs is only supported on linux hosts, only the / character is
checked at the moment. When support for other hosts (AKA. win32) is added,
other chars may need to be blacklisted as well.
If a client sends an illegal path component, the request will fail and
ENOENT is returned to the client.
[1] http://man.cat-v.org/plan_9/5/walk
[2] http://man.cat-v.org/plan_9/5/intro
Suggested-by: Peter Maydell <address@hidden>
Signed-off-by: Greg Kurz <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>
(cherry picked from commit fff39a7ad09da07ef490de05c92c91f22f8002f2)
Signed-off-by: Michael Roth <address@hidden>
---
hw/9pfs/9p.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 56 insertions(+)
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index f5e3012..53c466b 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -1254,6 +1254,11 @@ static int v9fs_walk_marshal(V9fsPDU *pdu, uint16_t
nwnames, V9fsQID *qids)
return offset;
}
+static bool name_is_illegal(const char *name)
+{
+ return !*name || strchr(name, '/') != NULL;
+}
+
static void v9fs_walk(void *opaque)
{
int name_idx;
@@ -1287,6 +1292,10 @@ static void v9fs_walk(void *opaque)
if (err < 0) {
goto out_nofid;
}
+ if (name_is_illegal(wnames[i].data)) {
+ err = -ENOENT;
+ goto out_nofid;
+ }
offset += err;
}
} else if (nwnames > P9_MAXWELEM) {
@@ -1481,6 +1490,11 @@ static void v9fs_lcreate(void *opaque)
}
trace_v9fs_lcreate(pdu->tag, pdu->id, dfid, flags, mode, gid);
+ if (name_is_illegal(name.data)) {
+ err = -ENOENT;
+ goto out_nofid;
+ }
+
fidp = get_fid(pdu, dfid);
if (fidp == NULL) {
err = -ENOENT;
@@ -2066,6 +2080,11 @@ static void v9fs_create(void *opaque)
}
trace_v9fs_create(pdu->tag, pdu->id, fid, name.data, perm, mode);
+ if (name_is_illegal(name.data)) {
+ err = -ENOENT;
+ goto out_nofid;
+ }
+
fidp = get_fid(pdu, fid);
if (fidp == NULL) {
err = -EINVAL;
@@ -2231,6 +2250,11 @@ static void v9fs_symlink(void *opaque)
}
trace_v9fs_symlink(pdu->tag, pdu->id, dfid, name.data, symname.data, gid);
+ if (name_is_illegal(name.data)) {
+ err = -ENOENT;
+ goto out_nofid;
+ }
+
dfidp = get_fid(pdu, dfid);
if (dfidp == NULL) {
err = -EINVAL;
@@ -2305,6 +2329,11 @@ static void v9fs_link(void *opaque)
}
trace_v9fs_link(pdu->tag, pdu->id, dfid, oldfid, name.data);
+ if (name_is_illegal(name.data)) {
+ err = -ENOENT;
+ goto out_nofid;
+ }
+
dfidp = get_fid(pdu, dfid);
if (dfidp == NULL) {
err = -ENOENT;
@@ -2387,6 +2416,12 @@ static void v9fs_unlinkat(void *opaque)
if (err < 0) {
goto out_nofid;
}
+
+ if (name_is_illegal(name.data)) {
+ err = -ENOENT;
+ goto out_nofid;
+ }
+
dfidp = get_fid(pdu, dfid);
if (dfidp == NULL) {
err = -EINVAL;
@@ -2493,6 +2528,12 @@ static void v9fs_rename(void *opaque)
if (err < 0) {
goto out_nofid;
}
+
+ if (name_is_illegal(name.data)) {
+ err = -ENOENT;
+ goto out_nofid;
+ }
+
fidp = get_fid(pdu, fid);
if (fidp == NULL) {
err = -ENOENT;
@@ -2605,6 +2646,11 @@ static void v9fs_renameat(void *opaque)
goto out_err;
}
+ if (name_is_illegal(old_name.data) || name_is_illegal(new_name.data)) {
+ err = -ENOENT;
+ goto out_err;
+ }
+
v9fs_path_write_lock(s);
err = v9fs_complete_renameat(pdu, olddirfid,
&old_name, newdirfid, &new_name);
@@ -2815,6 +2861,11 @@ static void v9fs_mknod(void *opaque)
}
trace_v9fs_mknod(pdu->tag, pdu->id, fid, mode, major, minor);
+ if (name_is_illegal(name.data)) {
+ err = -ENOENT;
+ goto out_nofid;
+ }
+
fidp = get_fid(pdu, fid);
if (fidp == NULL) {
err = -ENOENT;
@@ -2966,6 +3017,11 @@ static void v9fs_mkdir(void *opaque)
}
trace_v9fs_mkdir(pdu->tag, pdu->id, fid, name.data, mode, gid);
+ if (name_is_illegal(name.data)) {
+ err = -ENOENT;
+ goto out_nofid;
+ }
+
fidp = get_fid(pdu, fid);
if (fidp == NULL) {
err = -ENOENT;
--
1.9.1
- [Qemu-devel] [PATCH 22/25] crypto: ensure XTS is only used with ciphers with 16 byte blocks, (continued)
- [Qemu-devel] [PATCH 22/25] crypto: ensure XTS is only used with ciphers with 16 byte blocks, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 16/25] scsi: pvscsi: limit process IO loop to ring size, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 18/25] scsi-disk: change disk serial length from 20 to 36, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 17/25] qemu-char: avoid segfault if user lacks of permisson of a given logfile, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 20/25] scsi: mptconfig: fix an assert expression, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 02/25] ui: fix refresh of VNC server surface, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 19/25] vmw_pvscsi: check page count while initialising descriptor rings, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 03/25] virtio: recalculate vq->inuse after migration, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 21/25] scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACK, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 24/25] scsi-disk: Cleaning up around tray open state, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 08/25] 9pfs: forbid illegal path names,
Michael Roth <=
- [Qemu-devel] [PATCH 07/25] net: vmxnet: use g_new for pkt initialisation, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 04/25] virtio: decrement vq->inuse in virtqueue_discard(), Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 06/25] net: vmxnet: check IP header length, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 25/25] virtio-scsi: Don't abort when media is ejected, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 23/25] iothread: Stop threads before main() quits, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 05/25] iscsi: pass SCSI status back for SG_IO, Michael Roth, 2016/09/20
- [Qemu-devel] [PATCH 01/25] net: check fragment length during fragmentation, Michael Roth, 2016/09/20
- Re: [Qemu-devel] [PATCH 00/25] Patch Round-up for stable 2.6.2, freeze on 2016-08-26, Eric Blake, 2016/09/20