[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2 039/109] virtiofsd: validate path components
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PATCH v2 039/109] virtiofsd: validate path components |
Date: |
Tue, 21 Jan 2020 12:23:23 +0000 |
From: Stefan Hajnoczi <address@hidden>
Several FUSE requests contain single path components. A correct FUSE
client sends well-formed path components but there is currently no input
validation in case something went wrong or the client is malicious.
Refuse ".", "..", and paths containing '/' when we expect a path
component.
Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Daniel P. Berrangé <address@hidden>
---
tools/virtiofsd/passthrough_ll.c | 59 ++++++++++++++++++++++++++++----
1 file changed, 53 insertions(+), 6 deletions(-)
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index a207f7a97b..3aa26b4255 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -132,6 +132,21 @@ static void unref_inode(struct lo_data *lo, struct
lo_inode *inode, uint64_t n);
static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
+static int is_dot_or_dotdot(const char *name)
+{
+ return name[0] == '.' &&
+ (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
+}
+
+/* Is `path` a single path component that is not "." or ".."? */
+static int is_safe_path_component(const char *path)
+{
+ if (strchr(path, '/')) {
+ return 0;
+ }
+
+ return !is_dot_or_dotdot(path);
+}
static struct lo_data *lo_data(fuse_req_t req)
{
@@ -680,6 +695,15 @@ static void lo_lookup(fuse_req_t req, fuse_ino_t parent,
const char *name)
parent, name);
}
+ /*
+ * Don't use is_safe_path_component(), allow "." and ".." for NFS export
+ * support.
+ */
+ if (strchr(name, '/')) {
+ fuse_reply_err(req, EINVAL);
+ return;
+ }
+
err = lo_do_lookup(req, parent, name, &e);
if (err) {
fuse_reply_err(req, err);
@@ -761,6 +785,11 @@ static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t
parent,
struct fuse_entry_param e;
struct lo_cred old = {};
+ if (!is_safe_path_component(name)) {
+ fuse_reply_err(req, EINVAL);
+ return;
+ }
+
dir = lo_inode(req, parent);
if (!dir) {
fuse_reply_err(req, EBADF);
@@ -862,6 +891,11 @@ static void lo_link(fuse_req_t req, fuse_ino_t ino,
fuse_ino_t parent,
struct fuse_entry_param e;
int saverr;
+ if (!is_safe_path_component(name)) {
+ fuse_reply_err(req, EINVAL);
+ return;
+ }
+
inode = lo_inode(req, ino);
if (!inode) {
fuse_reply_err(req, EBADF);
@@ -903,6 +937,10 @@ out_err:
static void lo_rmdir(fuse_req_t req, fuse_ino_t parent, const char *name)
{
int res;
+ if (!is_safe_path_component(name)) {
+ fuse_reply_err(req, EINVAL);
+ return;
+ }
res = unlinkat(lo_fd(req, parent), name, AT_REMOVEDIR);
@@ -915,6 +953,11 @@ static void lo_rename(fuse_req_t req, fuse_ino_t parent,
const char *name,
{
int res;
+ if (!is_safe_path_component(name) || !is_safe_path_component(newname)) {
+ fuse_reply_err(req, EINVAL);
+ return;
+ }
+
if (flags) {
fuse_reply_err(req, EINVAL);
return;
@@ -929,6 +972,11 @@ static void lo_unlink(fuse_req_t req, fuse_ino_t parent,
const char *name)
{
int res;
+ if (!is_safe_path_component(name)) {
+ fuse_reply_err(req, EINVAL);
+ return;
+ }
+
res = unlinkat(lo_fd(req, parent), name, 0);
fuse_reply_err(req, res == -1 ? errno : 0);
@@ -1092,12 +1140,6 @@ out_err:
fuse_reply_err(req, error);
}
-static int is_dot_or_dotdot(const char *name)
-{
- return name[0] == '.' &&
- (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
-}
-
static void lo_do_readdir(fuse_req_t req, fuse_ino_t ino, size_t size,
off_t offset, struct fuse_file_info *fi, int plus)
{
@@ -1247,6 +1289,11 @@ static void lo_create(fuse_req_t req, fuse_ino_t parent,
const char *name,
parent, name);
}
+ if (!is_safe_path_component(name)) {
+ fuse_reply_err(req, EINVAL);
+ return;
+ }
+
err = lo_change_cred(req, &old);
if (err) {
goto out;
--
2.24.1
- [PATCH v2 029/109] virtiofsd: make -f (foreground) the default, (continued)
- [PATCH v2 029/109] virtiofsd: make -f (foreground) the default, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 030/109] virtiofsd: add vhost-user.json file, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 031/109] virtiofsd: add --print-capabilities option, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 033/109] virtiofsd: passthrough_ll: create new files in caller's context, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 032/109] virtiofs: Add maintainers entry, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 034/109] virtiofsd: passthrough_ll: add lo_map for ino/fh indirection, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 035/109] virtiofsd: passthrough_ll: add ino_map to hide lo_inode pointers, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 036/109] virtiofsd: passthrough_ll: add dirp_map to hide lo_dirp pointers, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 037/109] virtiofsd: passthrough_ll: add fd_map to hide file descriptors, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 038/109] virtiofsd: passthrough_ll: add fallback for racy ops, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 039/109] virtiofsd: validate path components,
Dr. David Alan Gilbert (git) <=
- [PATCH v2 040/109] virtiofsd: Plumb fuse_bufvec through to do_write_buf, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 041/109] virtiofsd: Pass write iov's all the way through, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 042/109] virtiofsd: add fuse_mbuf_iter API, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 043/109] virtiofsd: validate input buffer sizes in do_write_buf(), Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 045/109] virtiofsd: prevent ".." escape in lo_do_lookup(), Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 044/109] virtiofsd: check input buffer size in fuse_lowlevel.c ops, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 046/109] virtiofsd: prevent ".." escape in lo_do_readdir(), Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 047/109] virtiofsd: use /proc/self/fd/ O_PATH file descriptor, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 048/109] virtiofsd: sandbox mount namespace, Dr. David Alan Gilbert (git), 2020/01/21
- [PATCH v2 049/109] virtiofsd: move to an empty network namespace, Dr. David Alan Gilbert (git), 2020/01/21