[PATCH] 9pfs: Fix segfault in do_readdir_many caused by struct dirent overread

[Vitaly Chikunov]

`struct dirent' returned from readdir(3) could be shorter than
`sizeof(struct dirent)', thus memcpy of sizeof length will overread
into unallocated page causing SIGSEGV. Example stack trace:

 #0  0x00005555559ebeed v9fs_co_readdir_many (/usr/bin/qemu-system-x86_64 + 
0x497eed)
 #1  0x00005555559ec2e9 v9fs_readdir (/usr/bin/qemu-system-x86_64 + 0x4982e9)
 #2  0x0000555555eb7983 coroutine_trampoline (/usr/bin/qemu-system-x86_64 + 
0x963983)
 #3  0x00007ffff73e0be0 n/a (n/a + 0x0)

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/841
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
---
Tested on x86-64 Linux.

 hw/9pfs/codir.c      |  7 +++++--
 include/qemu/osdep.h |  6 ++++++
 util/osdep.c         | 23 +++++++++++++++++++++++
 3 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/hw/9pfs/codir.c b/hw/9pfs/codir.c
index 032cce04c4..ea7f5e6578 100644
--- a/hw/9pfs/codir.c
+++ b/hw/9pfs/codir.c
@@ -143,8 +143,11 @@ static int do_readdir_many(V9fsPDU *pdu, V9fsFidState 
*fidp,
         } else {
             e = e->next = g_malloc0(sizeof(V9fsDirEnt));
         }
-        e->dent = g_malloc0(sizeof(struct dirent));
-        memcpy(e->dent, dent, sizeof(struct dirent));
+        e->dent = qemu_dirent_dup(dent);
+        if (!e->dent) {
+            err = -errno;
+            break;
+        }
 
         /* perform a full stat() for directory entry if requested by caller */
         if (dostat) {
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index d1660d67fa..b54d22db04 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -805,6 +805,12 @@ static inline int platform_does_not_support_system(const 
char *command)
 }
 #endif /* !HAVE_SYSTEM_FUNCTION */
 
+/**
+ * Actual 'struct dirent' size may be bigger or shorter than
+ * sizeof(struct dirent) in many cases.
+ */
+struct dirent *qemu_dirent_dup(struct dirent *dent);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/util/osdep.c b/util/osdep.c
index 42a0a4986a..e39d1071fd 100644
--- a/util/osdep.c
+++ b/util/osdep.c
@@ -33,6 +33,7 @@
 extern int madvise(char *, size_t, int);
 #endif
 
+#include <dirent.h>
 #include "qemu-common.h"
 #include "qemu/cutils.h"
 #include "qemu/sockets.h"
@@ -615,3 +616,25 @@ writev(int fd, const struct iovec *iov, int iov_cnt)
     return readv_writev(fd, iov, iov_cnt, true);
 }
 #endif
+
+struct dirent *
+qemu_dirent_dup(struct dirent *dent)
+{
+    struct dirent *dst;
+#if defined _DIRENT_HAVE_D_RECLEN
+    /* Avoid use of strlen() if there's d_reclen. */
+    dst = g_malloc(dent->d_reclen);
+#else
+    /* Fallback to a most portable way. */
+    const size_t reclen = offsetof(struct dirent, d_name) + 
strlen(dent->d_name) + 1;
+
+    dst = g_malloc(reclen);
+#endif
+    if (!dst)
+        return NULL;
+#ifdef _DIRENT_HAVE_D_RECLEN
+    return memcpy(dst, dent, dent->d_reclen);
+#else
+    return memcpy(dst, dent, reclen);
+#endif
+}
-- 
2.33.0