debian/patches/extra/0001-9pfs-forbid-illegal-path-names.patch

   1 From 21289fc663198d96ae2ca145a425f2e21ed4637a Mon Sep 17 00:00:00 2001
   2 From: Greg Kurz <groug@kaod.org>
   3 Date: Tue, 30 Aug 2016 19:11:05 +0200
   4 Subject: [PATCH 1/6] 9pfs: forbid illegal path names
   5
   6 Empty path components don't make sense for most commands and may cause
   7 undefined behavior, depending on the backend.
   8
   9 Also, the walk request described in the 9P spec [1] clearly shows that
  10 the client is supposed to send individual path components: the official
  11 linux client never sends portions of path containing the / character for
  12 example.
  13
  14 Moreover, the 9P spec [2] also states that a system can decide to restrict
  15 the set of supported characters used in path components, with an explicit
  16 mention "to remove slashes from name components".
  17
  18 This patch introduces a new name_is_illegal() helper that checks the
  19 names sent by the client are not empty and don't contain unwanted chars.
  20 Since 9pfs is only supported on linux hosts, only the / character is
  21 checked at the moment. When support for other hosts (AKA. win32) is added,
  22 other chars may need to be blacklisted as well.
  23
  24 If a client sends an illegal path component, the request will fail and
  25 ENOENT is returned to the client.
  26
  27 [1] http://man.cat-v.org/plan_9/5/walk
  28 [2] http://man.cat-v.org/plan_9/5/intro
  29
  30 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
  31 Signed-off-by: Greg Kurz <groug@kaod.org>
  32 Reviewed-by: Eric Blake <eblake@redhat.com>
  33 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
  34 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
  35 ---
  36  hw/9pfs/9p.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  37  1 file changed, 56 insertions(+)
  38
  39 diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
  40 index f5e3012..53c466b 100644
  41 --- a/hw/9pfs/9p.c
  42 +++ b/hw/9pfs/9p.c
  43 @@ -1254,6 +1254,11 @@ static int v9fs_walk_marshal(V9fsPDU *pdu, uint16_t nwnames, V9fsQID *qids)
  44      return offset;
  45  }
  46
  47 +static bool name_is_illegal(const char *name)
  48 +{
  49 +    return !*name || strchr(name, '/') != NULL;
  50 +}
  51 +
  52  static void v9fs_walk(void *opaque)
  53  {
  54      int name_idx;
  55 @@ -1287,6 +1292,10 @@ static void v9fs_walk(void *opaque)
  56              if (err < 0) {
  57                  goto out_nofid;
  58              }
  59 +            if (name_is_illegal(wnames[i].data)) {
  60 +                err = -ENOENT;
  61 +                goto out_nofid;
  62 +            }
  63              offset += err;
  64          }
  65      } else if (nwnames > P9_MAXWELEM) {
  66 @@ -1481,6 +1490,11 @@ static void v9fs_lcreate(void *opaque)
  67      }
  68      trace_v9fs_lcreate(pdu->tag, pdu->id, dfid, flags, mode, gid);
  69
  70 +    if (name_is_illegal(name.data)) {
  71 +        err = -ENOENT;
  72 +        goto out_nofid;
  73 +    }
  74 +
  75      fidp = get_fid(pdu, dfid);
  76      if (fidp == NULL) {
  77          err = -ENOENT;
  78 @@ -2066,6 +2080,11 @@ static void v9fs_create(void *opaque)
  79      }
  80      trace_v9fs_create(pdu->tag, pdu->id, fid, name.data, perm, mode);
  81
  82 +    if (name_is_illegal(name.data)) {
  83 +        err = -ENOENT;
  84 +        goto out_nofid;
  85 +    }
  86 +
  87      fidp = get_fid(pdu, fid);
  88      if (fidp == NULL) {
  89          err = -EINVAL;
  90 @@ -2231,6 +2250,11 @@ static void v9fs_symlink(void *opaque)
  91      }
  92      trace_v9fs_symlink(pdu->tag, pdu->id, dfid, name.data, symname.data, gid);
  93
  94 +    if (name_is_illegal(name.data)) {
  95 +        err = -ENOENT;
  96 +        goto out_nofid;
  97 +    }
  98 +
  99      dfidp = get_fid(pdu, dfid);
 100      if (dfidp == NULL) {
 101          err = -EINVAL;
 102 @@ -2305,6 +2329,11 @@ static void v9fs_link(void *opaque)
 103      }
 104      trace_v9fs_link(pdu->tag, pdu->id, dfid, oldfid, name.data);
 105
 106 +    if (name_is_illegal(name.data)) {
 107 +        err = -ENOENT;
 108 +        goto out_nofid;
 109 +    }
 110 +
 111      dfidp = get_fid(pdu, dfid);
 112      if (dfidp == NULL) {
 113          err = -ENOENT;
 114 @@ -2387,6 +2416,12 @@ static void v9fs_unlinkat(void *opaque)
 115      if (err < 0) {
 116          goto out_nofid;
 117      }
 118 +
 119 +    if (name_is_illegal(name.data)) {
 120 +        err = -ENOENT;
 121 +        goto out_nofid;
 122 +    }
 123 +
 124      dfidp = get_fid(pdu, dfid);
 125      if (dfidp == NULL) {
 126          err = -EINVAL;
 127 @@ -2493,6 +2528,12 @@ static void v9fs_rename(void *opaque)
 128      if (err < 0) {
 129          goto out_nofid;
 130      }
 131 +
 132 +    if (name_is_illegal(name.data)) {
 133 +        err = -ENOENT;
 134 +        goto out_nofid;
 135 +    }
 136 +
 137      fidp = get_fid(pdu, fid);
 138      if (fidp == NULL) {
 139          err = -ENOENT;
 140 @@ -2605,6 +2646,11 @@ static void v9fs_renameat(void *opaque)
 141          goto out_err;
 142      }
 143
 144 +    if (name_is_illegal(old_name.data) || name_is_illegal(new_name.data)) {
 145 +        err = -ENOENT;
 146 +        goto out_err;
 147 +    }
 148 +
 149      v9fs_path_write_lock(s);
 150      err = v9fs_complete_renameat(pdu, olddirfid,
 151                                   &old_name, newdirfid, &new_name);
 152 @@ -2815,6 +2861,11 @@ static void v9fs_mknod(void *opaque)
 153      }
 154      trace_v9fs_mknod(pdu->tag, pdu->id, fid, mode, major, minor);
 155
 156 +    if (name_is_illegal(name.data)) {
 157 +        err = -ENOENT;
 158 +        goto out_nofid;
 159 +    }
 160 +
 161      fidp = get_fid(pdu, fid);
 162      if (fidp == NULL) {
 163          err = -ENOENT;
 164 @@ -2966,6 +3017,11 @@ static void v9fs_mkdir(void *opaque)
 165      }
 166      trace_v9fs_mkdir(pdu->tag, pdu->id, fid, name.data, mode, gid);
 167
 168 +    if (name_is_illegal(name.data)) {
 169 +        err = -ENOENT;
 170 +        goto out_nofid;
 171 +    }
 172 +
 173      fidp = get_fid(pdu, fid);
 174      if (fidp == NULL) {
 175          err = -ENOENT;
 176 --
 177 2.1.4
 178