From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57623) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bdMMv-0003r9-Nb for qemu-devel@nongnu.org; Fri, 26 Aug 2016 15:00:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bdMMr-0001iN-NG for qemu-devel@nongnu.org; Fri, 26 Aug 2016 15:00:45 -0400 Received: from mx1.redhat.com ([209.132.183.28]:52048) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bdMMr-0001hz-BC for qemu-devel@nongnu.org; Fri, 26 Aug 2016 15:00:41 -0400 References: <147222401281.18925.1894824578752486297.stgit@bahia.lan> <147222405454.18925.2135759955496138955.stgit@bahia.lan> From: Eric Blake Message-ID: <57C091D5.6050101@redhat.com> Date: Fri, 26 Aug 2016 14:00:37 -0500 MIME-Version: 1.0 In-Reply-To: <147222405454.18925.2135759955496138955.stgit@bahia.lan> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="5WhSvovFrmTflPskVTNTNftXjoKwVMxhb" Subject: Re: [Qemu-devel] [PATCH v2 5/5] 9p: forbid empty extension string List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Greg Kurz , qemu-devel@nongnu.org Cc: Peter Maydell , Felix Wilhelm , "Michael S. Tsirkin" , P J P , "Aneesh Kumar K.V" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --5WhSvovFrmTflPskVTNTNftXjoKwVMxhb Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 08/26/2016 10:07 AM, Greg Kurz wrote: > A buggy guest using the 9p2000.u protocol can issue a create request an= d > pass an empty string as the extension argument. This causes QEMU to cra= sh > in the case of a hard link or a special file, and leads to undefined > behavior, depending on the backend, in the case of a symbolic link. >=20 > This patch causes the request to fail with EINVAL in these scenarios. >=20 > Signed-off-by: Greg Kurz > --- > hw/9pfs/9p.c | 21 +++++++++++++++++++-- > 1 file changed, 19 insertions(+), 2 deletions(-) >=20 > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c > index 7b1dfe4e47cb..dc65c3125006 100644 > --- a/hw/9pfs/9p.c > +++ b/hw/9pfs/9p.c > @@ -2150,6 +2150,11 @@ static void v9fs_create(void *opaque) > } > fidp->fid_type =3D P9_FID_DIR; > } else if (perm & P9_STAT_MODE_SYMLINK) { > + if (extension.data =3D=3D NULL) { > + err =3D -EINVAL; > + goto out; > + } POSIX specifically requires implementations to support creating a symlink whose target is the empty string. Linux doesn't [yet] permit it, but BSD does. On systems where creating such a symlink is legal, POSIX requires that such a symlink either be treated as "." if dereferenced, or be treated as ENOENT on attempt to dereference. But since such links can be created, readlink() should be able to read them without error. I would argue that we should NOT forbid empty symlinks on creation (but pass back any error from the underlying host OS); but instead check that dereferencing such a symlink behaves sanely if it was created. Meanwhile, a client should not be relying on the behavior (since Linux disobeys POSIX, portable clients should already be avoiding empty symlink= s). http://austingroupbugs.net/view.php?id=3D649 > @@ -2161,8 +2166,15 @@ static void v9fs_create(void *opaque) > } > v9fs_path_copy(&fidp->path, &path); > } else if (perm & P9_STAT_MODE_LINK) { > - int32_t ofid =3D atoi(extension.data); > - V9fsFidState *ofidp =3D get_fid(pdu, ofid); > + V9fsFidState *ofidp; > + > + if (extension.data =3D=3D NULL) { > + err =3D -EINVAL; > + goto out; > + } Rejecting an empty destination on hard link or device creation, however, is indeed appropriate. --=20 Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --5WhSvovFrmTflPskVTNTNftXjoKwVMxhb Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJXwJHVAAoJEKeha0olJ0NqSB0IAJo/78P5oGFOrw0PTIScW+U5 nQy5de+UL4Ps6UUmdgOkLo2O7FW3wmFzGV8VyWcFEeZN/aFF3Y9RkI8vom5sMmAj 3ZAX5yP4oITJAA4o/1wFai1ogbNEip4HHuFTPcLzWs5B2WU8vZrdgUj9ichqQak1 7CM2SdYMHCf4RpfuBsSHJcBRrfGWTXXqX1hPOo0G3oNd8is+egLqH7GRGpzJRxnM FSt4b0OLUUkFVc6xfxrIi4gHCKd0ObOYEDwMF+yOe0IaFRHi85gH4QNTBxHSrcrr klFJDPXlrsM5icUtW1SYd0lL3JrF4V98VGOcWk9cl2xtVsqCQcRTLuRJ2H/Mn7g= =IuHt -----END PGP SIGNATURE----- --5WhSvovFrmTflPskVTNTNftXjoKwVMxhb--