From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57899) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c0pK9-0003ZV-VB for qemu-devel@nongnu.org; Sun, 30 Oct 2016 08:34:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c0pK6-0001qr-Lo for qemu-devel@nongnu.org; Sun, 30 Oct 2016 08:34:54 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:57660) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1c0pK6-0001qJ-CP for qemu-devel@nongnu.org; Sun, 30 Oct 2016 08:34:50 -0400 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u9UCXP1J009059 for ; Sun, 30 Oct 2016 08:34:49 -0400 Received: from e06smtp11.uk.ibm.com (e06smtp11.uk.ibm.com [195.75.94.107]) by mx0a-001b2d01.pphosted.com with ESMTP id 26cquu5hg8-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Sun, 30 Oct 2016 08:34:49 -0400 Received: from localhost by e06smtp11.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Sun, 30 Oct 2016 12:34:47 -0000 Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by d06dlp01.portsmouth.uk.ibm.com (Postfix) with ESMTP id 65DF917D805D for ; Sun, 30 Oct 2016 12:37:00 +0000 (GMT) Received: from d06av06.portsmouth.uk.ibm.com (d06av06.portsmouth.uk.ibm.com [9.149.37.217]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u9UCYhhI43450586 for ; Sun, 30 Oct 2016 12:34:43 GMT Received: from d06av06.portsmouth.uk.ibm.com (localhost [127.0.0.1]) by d06av06.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id u9UCYhm1022473 for ; Sun, 30 Oct 2016 08:34:43 -0400 From: Greg Kurz Date: Sun, 30 Oct 2016 13:34:25 +0100 In-Reply-To: <1477830868-12274-1-git-send-email-groug@kaod.org> References: <1477830868-12274-1-git-send-email-groug@kaod.org> Message-Id: <1477830868-12274-5-git-send-email-groug@kaod.org> Subject: [Qemu-devel] [PULL 4/7] 9pfs: limit xattr size in xattrcreate List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , "Aneesh Kumar K.V" , Greg Kurz We shouldn't allow guests to create extended attribute with arbitrary sizes. On linux hosts, the limit is XATTR_SIZE_MAX. Let's use it. Signed-off-by: Greg Kurz --- hw/9pfs/9p.c | 7 ++++++- hw/9pfs/trace-events | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 7705ead4b2ac..27af0072599a 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3247,7 +3247,7 @@ static void coroutine_fn v9fs_xattrcreate(void *opaque) { int flags; int32_t fid; - int64_t size; + uint64_t size; ssize_t err = 0; V9fsString name; size_t offset = 7; @@ -3262,6 +3262,11 @@ static void coroutine_fn v9fs_xattrcreate(void *opaque) } trace_v9fs_xattrcreate(pdu->tag, pdu->id, fid, name.data, size, flags); + if (size > XATTR_SIZE_MAX) { + err = -E2BIG; + goto out_nofid; + } + file_fidp = get_fid(pdu, fid); if (file_fidp == NULL) { err = -EINVAL; diff --git a/hw/9pfs/trace-events b/hw/9pfs/trace-events index 48d3d8abedb5..fb4de3d465ab 100644 --- a/hw/9pfs/trace-events +++ b/hw/9pfs/trace-events @@ -42,6 +42,6 @@ v9fs_mkdir(uint16_t tag, uint8_t id, int32_t fid, char* name, int mode, uint32_t v9fs_mkdir_return(uint16_t tag, uint8_t id, int8_t type, int32_t version, int64_t path, int err) "tag %u id %u qid={type %d version %d path %"PRId64"} err %d" v9fs_xattrwalk(uint16_t tag, uint8_t id, int32_t fid, int32_t newfid, char* name) "tag %d id %d fid %d newfid %d name %s" v9fs_xattrwalk_return(uint16_t tag, uint8_t id, int64_t size) "tag %d id %d size %"PRId64 -v9fs_xattrcreate(uint16_t tag, uint8_t id, int32_t fid, char* name, int64_t size, int flags) "tag %d id %d fid %d name %s size %"PRId64" flags %d" +v9fs_xattrcreate(uint16_t tag, uint8_t id, int32_t fid, char* name, uint64_t size, int flags) "tag %d id %d fid %d name %s size %"PRIu64" flags %d" v9fs_readlink(uint16_t tag, uint8_t id, int32_t fid) "tag %d id %d fid %d" v9fs_readlink_return(uint16_t tag, uint8_t id, char* target) "tag %d id %d name %s" -- 2.5.5