diff options
| author | Greg Kurz <groug@kaod.org> | 2016-11-01 12:00:40 +0100 |
|---|---|---|
| committer | Greg Kurz <groug@kaod.org> | 2016-11-01 12:03:02 +0100 |
| commit | 3b79ef2cf48805dc693a8b0c82e05e0abeaa64f8 (patch) | |
| tree | 9c45ece6eeec3315250fd1e11bfc00d790c53956 | |
| parent | 7e55d65c56a03dcd2c5d7c49d37c5a74b55d4bd6 (diff) | |
| download | qemu-3b79ef2cf48805dc693a8b0c82e05e0abeaa64f8.tar.gz | |
9pfs: limit xattr size in xattrcreate
We shouldn't allow guests to create extended attribute with arbitrary sizes.
On linux hosts, the limit is XATTR_SIZE_MAX. Let's use it.
Signed-off-by: Greg Kurz <groug@kaod.org>
| -rw-r--r-- | hw/9pfs/9p.c | 7 | ||||
| -rw-r--r-- | hw/9pfs/trace-events | 2 |
2 files changed, 7 insertions, 2 deletions
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 7705ead4b2..27af007259 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3247,7 +3247,7 @@ static void coroutine_fn v9fs_xattrcreate(void *opaque) { int flags; int32_t fid; - int64_t size; + uint64_t size; ssize_t err = 0; V9fsString name; size_t offset = 7; @@ -3262,6 +3262,11 @@ static void coroutine_fn v9fs_xattrcreate(void *opaque) } trace_v9fs_xattrcreate(pdu->tag, pdu->id, fid, name.data, size, flags); + if (size > XATTR_SIZE_MAX) { + err = -E2BIG; + goto out_nofid; + } + file_fidp = get_fid(pdu, fid); if (file_fidp == NULL) { err = -EINVAL; diff --git a/hw/9pfs/trace-events b/hw/9pfs/trace-events index 48d3d8abed..fb4de3d465 100644 --- a/hw/9pfs/trace-events +++ b/hw/9pfs/trace-events @@ -42,6 +42,6 @@ v9fs_mkdir(uint16_t tag, uint8_t id, int32_t fid, char* name, int mode, uint32_t v9fs_mkdir_return(uint16_t tag, uint8_t id, int8_t type, int32_t version, int64_t path, int err) "tag %u id %u qid={type %d version %d path %"PRId64"} err %d" v9fs_xattrwalk(uint16_t tag, uint8_t id, int32_t fid, int32_t newfid, char* name) "tag %d id %d fid %d newfid %d name %s" v9fs_xattrwalk_return(uint16_t tag, uint8_t id, int64_t size) "tag %d id %d size %"PRId64 -v9fs_xattrcreate(uint16_t tag, uint8_t id, int32_t fid, char* name, int64_t size, int flags) "tag %d id %d fid %d name %s size %"PRId64" flags %d" +v9fs_xattrcreate(uint16_t tag, uint8_t id, int32_t fid, char* name, uint64_t size, int flags) "tag %d id %d fid %d name %s size %"PRIu64" flags %d" v9fs_readlink(uint16_t tag, uint8_t id, int32_t fid) "tag %d id %d fid %d" v9fs_readlink_return(uint16_t tag, uint8_t id, char* target) "tag %d id %d name %s" |