motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-30 21:42:06 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

virtiofsd: fail when parent inode isn't known in lo_do_lookup()

Browse source 
The Linux file handle APIs (struct export_operations) can access inodes
that are not attached to parents because path name traversal is not
performed.  Refuse if there is no parent in lo_do_lookup().

Also clean up lo_do_lookup() while we're here.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
Miklos Szeredi 2019-11-20 14:14:29 +00:00 • committed by Dr. David Alan Gilbert
parent 95d2715791
commit 9de4fab599
1 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tools/virtiofsd/passthrough_ll.c
View file

@ -777,6 +777,15 @@ static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
struct lo_data *lo = lo_data(req); struct lo_data *lo = lo_data(req);
struct lo_inode *inode, *dir = lo_inode(req, parent); struct lo_inode *inode, *dir = lo_inode(req, parent);
/*
* name_to_handle_at() and open_by_handle_at() can reach here with fuse
* mount point in guest, but we don't have its inode info in the
* ino_map.
*/
if (!dir) {
return ENOENT;
}
memset(e, 0, sizeof(*e)); memset(e, 0, sizeof(*e));
e->attr_timeout = lo->timeout; e->attr_timeout = lo->timeout;
e->entry_timeout = lo->timeout; e->entry_timeout = lo->timeout;
@ -786,7 +795,7 @@ static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
name = "."; name = ".";
} }
newfd = openat(lo_fd(req, parent), name, O_PATH | O_NOFOLLOW); newfd = openat(dir->fd, name, O_PATH | O_NOFOLLOW);
if (newfd == -1) { if (newfd == -1) {
goto out_err; goto out_err;
} }
@ -796,7 +805,7 @@ static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
goto out_err; goto out_err;
} }
inode = lo_find(lo_data(req), &e->attr); inode = lo_find(lo, &e->attr);
if (inode) { if (inode) {
close(newfd); close(newfd);
newfd = -1; newfd = -1;
@ -812,6 +821,7 @@ static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
inode->is_symlink = S_ISLNK(e->attr.st_mode); inode->is_symlink = S_ISLNK(e->attr.st_mode);
inode->refcount = 1; inode->refcount = 1;
inode->fd = newfd; inode->fd = newfd;
newfd = -1;
inode->ino = e->attr.st_ino; inode->ino = e->attr.st_ino;
inode->dev = e->attr.st_dev; inode->dev = e->attr.st_dev;