* [PATCH-for-5.0] tools/virtiofsd/passthrough_ll: Fix double close()
@ 2020-03-21 12:06 Philippe Mathieu-Daudé
2020-03-21 12:17 ` Philippe Mathieu-Daudé
2020-03-23 11:08 ` Stefan Hajnoczi
0 siblings, 2 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2020-03-21 12:06 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Philippe Mathieu-Daudé,
Dr. David Alan Gilbert, Stefan Hajnoczi, qemu-stable
On success, the fdopendir() call closes fd. Later on the error
path we try to close an already-closed fd. This can lead to
use-after-free. Fix by only closing the fd if the fdopendir()
call failed.
Cc: qemu-stable@nongnu.org
Fixes: 7c6b66027 (Import passthrough_ll from libfuse fuse-3.8.0)
Reported-by: Coverity (CID 1421933 USE_AFTER_FREE)
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
tools/virtiofsd/passthrough_ll.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index 4f259aac70..4c35c95b25 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -1520,8 +1520,7 @@ out_err:
if (d) {
if (d->dp) {
closedir(d->dp);
- }
- if (fd != -1) {
+ } else if (fd != -1) {
close(fd);
}
free(d);
--
2.21.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH-for-5.0] tools/virtiofsd/passthrough_ll: Fix double close()
2020-03-21 12:06 [PATCH-for-5.0] tools/virtiofsd/passthrough_ll: Fix double close() Philippe Mathieu-Daudé
@ 2020-03-21 12:17 ` Philippe Mathieu-Daudé
2020-03-24 18:56 ` Dr. David Alan Gilbert
2020-03-23 11:08 ` Stefan Hajnoczi
1 sibling, 1 reply; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2020-03-21 12:17 UTC (permalink / raw)
To: qemu-devel
Cc: Peter Maydell, Dr. David Alan Gilbert, Stefan Hajnoczi,
qemu-stable
On 3/21/20 1:06 PM, Philippe Mathieu-Daudé wrote:
> On success, the fdopendir() call closes fd. Later on the error
> path we try to close an already-closed fd. This can lead to
> use-after-free. Fix by only closing the fd if the fdopendir()
> call failed.
>
> Cc: qemu-stable@nongnu.org
> Fixes: 7c6b66027 (Import passthrough_ll from libfuse fuse-3.8.0)
libfuse is correct, the bug was introduced in commit b39bce121b, so:
Fixes: b39bce121b (add dirp_map to hide lo_dirp pointers)
> Reported-by: Coverity (CID 1421933 USE_AFTER_FREE)
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
> tools/virtiofsd/passthrough_ll.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
> index 4f259aac70..4c35c95b25 100644
> --- a/tools/virtiofsd/passthrough_ll.c
> +++ b/tools/virtiofsd/passthrough_ll.c
> @@ -1520,8 +1520,7 @@ out_err:
> if (d) {
> if (d->dp) {
> closedir(d->dp);
> - }
> - if (fd != -1) {
> + } else if (fd != -1) {
> close(fd);
> }
> free(d);
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH-for-5.0] tools/virtiofsd/passthrough_ll: Fix double close()
2020-03-21 12:17 ` Philippe Mathieu-Daudé
@ 2020-03-24 18:56 ` Dr. David Alan Gilbert
0 siblings, 0 replies; 4+ messages in thread
From: Dr. David Alan Gilbert @ 2020-03-24 18:56 UTC (permalink / raw)
To: Philippe Mathieu-Daudé
Cc: Peter Maydell, qemu-devel, Stefan Hajnoczi, qemu-stable
* Philippe Mathieu-Daudé (philmd@redhat.com) wrote:
> On 3/21/20 1:06 PM, Philippe Mathieu-Daudé wrote:
> > On success, the fdopendir() call closes fd. Later on the error
> > path we try to close an already-closed fd. This can lead to
> > use-after-free. Fix by only closing the fd if the fdopendir()
> > call failed.
> >
> > Cc: qemu-stable@nongnu.org
> > Fixes: 7c6b66027 (Import passthrough_ll from libfuse fuse-3.8.0)
>
> libfuse is correct, the bug was introduced in commit b39bce121b, so:
>
> Fixes: b39bce121b (add dirp_map to hide lo_dirp pointers)
Queued with that tweak
> > Reported-by: Coverity (CID 1421933 USE_AFTER_FREE)
> > Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> > Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> > ---
> > tools/virtiofsd/passthrough_ll.c | 3 +--
> > 1 file changed, 1 insertion(+), 2 deletions(-)
> >
> > diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
> > index 4f259aac70..4c35c95b25 100644
> > --- a/tools/virtiofsd/passthrough_ll.c
> > +++ b/tools/virtiofsd/passthrough_ll.c
> > @@ -1520,8 +1520,7 @@ out_err:
> > if (d) {
> > if (d->dp) {
> > closedir(d->dp);
> > - }
> > - if (fd != -1) {
> > + } else if (fd != -1) {
> > close(fd);
> > }
> > free(d);
> >
>
>
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH-for-5.0] tools/virtiofsd/passthrough_ll: Fix double close()
2020-03-21 12:06 [PATCH-for-5.0] tools/virtiofsd/passthrough_ll: Fix double close() Philippe Mathieu-Daudé
2020-03-21 12:17 ` Philippe Mathieu-Daudé
@ 2020-03-23 11:08 ` Stefan Hajnoczi
1 sibling, 0 replies; 4+ messages in thread
From: Stefan Hajnoczi @ 2020-03-23 11:08 UTC (permalink / raw)
To: Philippe Mathieu-Daudé
Cc: Peter Maydell, qemu-stable, qemu-devel, Dr. David Alan Gilbert
[-- Attachment #1: Type: text/plain, Size: 726 bytes --]
On Sat, Mar 21, 2020 at 01:06:54PM +0100, Philippe Mathieu-Daudé wrote:
> On success, the fdopendir() call closes fd. Later on the error
> path we try to close an already-closed fd. This can lead to
> use-after-free. Fix by only closing the fd if the fdopendir()
> call failed.
>
> Cc: qemu-stable@nongnu.org
> Fixes: 7c6b66027 (Import passthrough_ll from libfuse fuse-3.8.0)
> Reported-by: Coverity (CID 1421933 USE_AFTER_FREE)
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
> tools/virtiofsd/passthrough_ll.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
Thanks!
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-03-24 18:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-03-21 12:06 [PATCH-for-5.0] tools/virtiofsd/passthrough_ll: Fix double close() Philippe Mathieu-Daudé
2020-03-21 12:17 ` Philippe Mathieu-Daudé
2020-03-24 18:56 ` Dr. David Alan Gilbert
2020-03-23 11:08 ` Stefan Hajnoczi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).