[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 13/79] 9pfs: local: fix unlink of alien files in ma
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 13/79] 9pfs: local: fix unlink of alien files in mapped-file mode |
Date: |
Mon, 28 Aug 2017 19:13:48 -0500 |
From: Greg Kurz <address@hidden>
When trying to remove a file from a directory, both created in non-mapped
mode, the file remains and EBADF is returned to the guest.
This is a regression introduced by commit "df4938a6651b 9pfs: local:
unlinkat: don't follow symlinks" when fixing CVE-2016-9602. It changed the
way we unlink the metadata file from
ret = remove("$dir/.virtfs_metadata/$name");
if (ret < 0 && errno != ENOENT) {
/* Error out */
}
/* Ignore absence of metadata */
to
fd = openat("$dir/.virtfs_metadata")
unlinkat(fd, "$name")
if (ret < 0 && errno != ENOENT) {
/* Error out */
}
/* Ignore absence of metadata */
If $dir was created in non-mapped mode, openat() fails with ENOENT and
we pass -1 to unlinkat(), which fails in turn with EBADF.
We just need to check the return of openat() and ignore ENOENT, in order
to restore the behaviour we had with remove().
Signed-off-by: Greg Kurz <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
[groug: rewrote the comments as suggested by Eric]
(cherry picked from commit 6a87e7929f97b86c5823d4616fa1aa7636b2f116)
Signed-off-by: Michael Roth <address@hidden>
---
hw/9pfs/9p-local.c | 34 +++++++++++++++-------------------
1 file changed, 15 insertions(+), 19 deletions(-)
diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
index f3ebca4..7a0c383 100644
--- a/hw/9pfs/9p-local.c
+++ b/hw/9pfs/9p-local.c
@@ -957,6 +957,14 @@ static int local_unlinkat_common(FsContext *ctx, int
dirfd, const char *name,
if (ctx->export_flags & V9FS_SM_MAPPED_FILE) {
int map_dirfd;
+ /* We need to remove the metadata as well:
+ * - the metadata directory if we're removing a directory
+ * - the metadata file in the parent's metadata directory
+ *
+ * If any of these are missing (ie, ENOENT) then we're probably
+ * trying to remove something that wasn't created in mapped-file
+ * mode. We just ignore the error.
+ */
if (flags == AT_REMOVEDIR) {
int fd;
@@ -964,32 +972,20 @@ static int local_unlinkat_common(FsContext *ctx, int
dirfd, const char *name,
if (fd == -1) {
goto err_out;
}
- /*
- * If directory remove .virtfs_metadata contained in the
- * directory
- */
ret = unlinkat(fd, VIRTFS_META_DIR, AT_REMOVEDIR);
close_preserve_errno(fd);
if (ret < 0 && errno != ENOENT) {
- /*
- * We didn't had the .virtfs_metadata file. May be file created
- * in non-mapped mode ?. Ignore ENOENT.
- */
goto err_out;
}
}
- /*
- * Now remove the name from parent directory
- * .virtfs_metadata directory.
- */
map_dirfd = openat_dir(dirfd, VIRTFS_META_DIR);
- ret = unlinkat(map_dirfd, name, 0);
- close_preserve_errno(map_dirfd);
- if (ret < 0 && errno != ENOENT) {
- /*
- * We didn't had the .virtfs_metadata file. May be file created
- * in non-mapped mode ?. Ignore ENOENT.
- */
+ if (map_dirfd != -1) {
+ ret = unlinkat(map_dirfd, name, 0);
+ close_preserve_errno(map_dirfd);
+ if (ret < 0 && errno != ENOENT) {
+ goto err_out;
+ }
+ } else if (errno != ENOENT) {
goto err_out;
}
}
--
2.7.4
- [Qemu-stable] [PATCH 00/79] Patch Round-up for stable 2.9.1, freeze on 2017-09-04, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 10/79] block: Do not unref bs->file on error in BD's open, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 12/79] replication: Make --disable-replication compile again, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 11/79] ACPI: don't call acpi_pcihp_device_plug_cb on xen, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 09/79] pci: deassert intx when pci device unrealize, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 14/79] coccinelle: Add script to remove useless QObject casts, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 16/79] qobject: Add helper macros for common scalar insertions, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 13/79] 9pfs: local: fix unlink of alien files in mapped-file mode,
Michael Roth <=
- [Qemu-stable] [PATCH 01/79] qga-win: Enable 'can-offline' field in 'guest-get-vcpus' reply, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 19/79] block: Reuse bs as backing hd for drive-backup sync=none, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 15/79] qobject: Drop useless QObject casts, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 17/79] s390x: Drop useless casts, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 22/79] qemu-img: wait for convert coroutines to complete, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 21/79] aio: add missing aio_notify() to aio_enable_external(), Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 20/79] hw/virtio: fix vhost user fails to startup when MQ, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 23/79] block/vhdx: Make vhdx_create() always set errp, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 25/79] blockdev: use drained_begin/end for qmp_block_resize, Michael Roth, 2017/08/28
- [Qemu-stable] [PATCH 26/79] target/xtensa: fix mapping direction in read/write simcalls, Michael Roth, 2017/08/28