From nobody Sat May 4 01:31:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1488822948013532.275860776981; Mon, 6 Mar 2017 09:55:48 -0800 (PST) Received: from localhost ([::1]:45340 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwrK-0005Lq-Fk for importer@patchew.org; Mon, 06 Mar 2017 12:55:46 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50622) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwqE-0005J0-J6 for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:41 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ckwqB-0005dO-DE for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:38 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:37020) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ckwqB-0005d6-3d for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:35 -0500 Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v26HrsHC092786 for ; Mon, 6 Mar 2017 12:54:32 -0500 Received: from e06smtp09.uk.ibm.com (e06smtp09.uk.ibm.com [195.75.94.105]) by mx0a-001b2d01.pphosted.com with ESMTP id 2917pm78mu-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 06 Mar 2017 12:54:32 -0500 Received: from localhost by e06smtp09.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 6 Mar 2017 17:54:30 -0000 Received: from d06dlp03.portsmouth.uk.ibm.com (9.149.20.15) by e06smtp09.uk.ibm.com (192.168.101.139) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 6 Mar 2017 17:54:27 -0000 Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by d06dlp03.portsmouth.uk.ibm.com (Postfix) with ESMTP id D82631B0804B; Mon, 6 Mar 2017 17:57:31 +0000 (GMT) Received: from d06av21.portsmouth.uk.ibm.com (d06av21.portsmouth.uk.ibm.com [9.149.105.232]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v26HsRef7995894; Mon, 6 Mar 2017 17:54:27 GMT Received: from d06av21.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A59AE52043; Mon, 6 Mar 2017 16:53:12 +0000 (GMT) Received: from smtp.lab.toulouse-stg.fr.ibm.com (unknown [9.101.4.1]) by d06av21.portsmouth.uk.ibm.com (Postfix) with ESMTP id 933C652041; Mon, 6 Mar 2017 16:53:12 +0000 (GMT) Received: from bahia.lan (icon-9-164-183-34.megacenter.de.ibm.com [9.164.183.34]) by smtp.lab.toulouse-stg.fr.ibm.com (Postfix) with ESMTP id D50CE220386; Mon, 6 Mar 2017 18:54:25 +0100 (CET) From: Greg Kurz To: qemu-devel@nongnu.org Date: Mon, 6 Mar 2017 18:54:05 +0100 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488822850-23070-1-git-send-email-groug@kaod.org> References: <1488822850-23070-1-git-send-email-groug@kaod.org> X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17030617-0036-0000-0000-0000037AD785 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17030617-0037-0000-0000-0000155A9AD2 Message-Id: <1488822850-23070-2-git-send-email-groug@kaod.org> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-06_17:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=4 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703060146 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PULL 1/6] 9pfs: fix bogus fd check in local_remove() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Greg Kurz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" This was spotted by Coverity as a fd leak. This is certainly true, but also local_remove() would always return without doing anything, unless the fd is zero, which is very unlikely. (Coverity issue CID1371732) Signed-off-by: Greg Kurz Reviewed-by: Eric Blake --- hw/9pfs/9p-local.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index f22a3c3654db..5db7104334d6 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -1008,7 +1008,7 @@ static int local_remove(FsContext *ctx, const char *p= ath) int err =3D -1; =20 dirfd =3D local_opendir_nofollow(ctx, dirpath); - if (dirfd) { + if (dirfd =3D=3D -1) { goto out; } =20 --=20 2.7.4 From nobody Sat May 4 01:31:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1488823055387943.2454650020709; Mon, 6 Mar 2017 09:57:35 -0800 (PST) Received: from localhost ([::1]:45353 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwt3-0006y5-K5 for importer@patchew.org; Mon, 06 Mar 2017 12:57:33 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50642) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwqH-0005Ka-LR for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:42 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ckwqE-0005dl-Dv for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:41 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:39231) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ckwqE-0005df-4U for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:38 -0500 Received: from pps.filterd (m0098393.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v26HrjSK011288 for ; Mon, 6 Mar 2017 12:54:36 -0500 Received: from e06smtp13.uk.ibm.com (e06smtp13.uk.ibm.com [195.75.94.109]) by mx0a-001b2d01.pphosted.com with ESMTP id 2917qmy9t1-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 06 Mar 2017 12:54:36 -0500 Received: from localhost by e06smtp13.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 6 Mar 2017 17:54:33 -0000 Received: from d06dlp02.portsmouth.uk.ibm.com (9.149.20.14) by e06smtp13.uk.ibm.com (192.168.101.143) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 6 Mar 2017 17:54:31 -0000 Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by d06dlp02.portsmouth.uk.ibm.com (Postfix) with ESMTP id 9FD5A219004D; Mon, 6 Mar 2017 17:53:30 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v26HsUMd8978892; Mon, 6 Mar 2017 17:54:30 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D7602A4057; Mon, 6 Mar 2017 17:54:27 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C54EAA4053; Mon, 6 Mar 2017 17:54:27 +0000 (GMT) Received: from smtp.lab.toulouse-stg.fr.ibm.com (unknown [9.101.4.1]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Mon, 6 Mar 2017 17:54:27 +0000 (GMT) Received: from bahia.lan (icon-9-164-183-34.megacenter.de.ibm.com [9.164.183.34]) by smtp.lab.toulouse-stg.fr.ibm.com (Postfix) with ESMTP id 5A5AA220386; Mon, 6 Mar 2017 18:54:29 +0100 (CET) From: Greg Kurz To: qemu-devel@nongnu.org Date: Mon, 6 Mar 2017 18:54:06 +0100 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488822850-23070-1-git-send-email-groug@kaod.org> References: <1488822850-23070-1-git-send-email-groug@kaod.org> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17030617-0012-0000-0000-000004DBC389 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17030617-0013-0000-0000-0000177E8510 Message-Id: <1488822850-23070-3-git-send-email-groug@kaod.org> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-06_17:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=4 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703060146 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by mx0a-001b2d01.pphosted.com id v26HrjSK011288 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PULL 2/6] 9pfs: fix fd leak in local_opendir() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Greg Kurz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Coverity issue CID1371731 Signed-off-by: Greg Kurz Reviewed-by: Daniel P. Berrange Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/9pfs/9p-local.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index 5db7104334d6..09f6a46d61b8 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -435,6 +435,7 @@ static int local_opendir(FsContext *ctx, =20 stream =3D fdopendir(dirfd); if (!stream) { + close(dirfd); return -1; } fs->dir.stream =3D stream; --=20 2.7.4 From nobody Sat May 4 01:31:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1488822953718430.82924627501666; Mon, 6 Mar 2017 09:55:53 -0800 (PST) Received: from localhost ([::1]:45341 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwrO-0005Ng-8u for importer@patchew.org; Mon, 06 Mar 2017 12:55:50 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50655) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwqK-0005MF-17 for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:45 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ckwqG-0005eJ-Sw for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:44 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:43515) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ckwqG-0005e4-Jt for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:40 -0500 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v26HrdKU096397 for ; Mon, 6 Mar 2017 12:54:38 -0500 Received: from e06smtp15.uk.ibm.com (e06smtp15.uk.ibm.com [195.75.94.111]) by mx0a-001b2d01.pphosted.com with ESMTP id 2917uupxtw-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 06 Mar 2017 12:54:38 -0500 Received: from localhost by e06smtp15.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 6 Mar 2017 17:54:36 -0000 Received: from d06dlp02.portsmouth.uk.ibm.com (9.149.20.14) by e06smtp15.uk.ibm.com (192.168.101.145) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 6 Mar 2017 17:54:34 -0000 Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by d06dlp02.portsmouth.uk.ibm.com (Postfix) with ESMTP id DFA90219004D; Mon, 6 Mar 2017 17:53:33 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v26HsXP910682792; Mon, 6 Mar 2017 17:54:33 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B01DAE058; Mon, 6 Mar 2017 17:54:27 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 32386AE057; Mon, 6 Mar 2017 17:54:27 +0000 (GMT) Received: from smtp.lab.toulouse-stg.fr.ibm.com (unknown [9.101.4.1]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Mon, 6 Mar 2017 17:54:27 +0000 (GMT) Received: from bahia.lan (icon-9-164-183-34.megacenter.de.ibm.com [9.164.183.34]) by smtp.lab.toulouse-stg.fr.ibm.com (Postfix) with ESMTP id 9EBE7220386; Mon, 6 Mar 2017 18:54:32 +0100 (CET) From: Greg Kurz To: qemu-devel@nongnu.org Date: Mon, 6 Mar 2017 18:54:07 +0100 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488822850-23070-1-git-send-email-groug@kaod.org> References: <1488822850-23070-1-git-send-email-groug@kaod.org> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17030617-0020-0000-0000-00000315C7A4 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17030617-0021-0000-0000-000040A6FD35 Message-Id: <1488822850-23070-4-git-send-email-groug@kaod.org> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-06_17:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=4 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703060146 Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by mx0a-001b2d01.pphosted.com id v26HrdKU096397 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PULL 3/6] 9pfs: fail local_statfs() earlier X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Greg Kurz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" If we cannot open the given path, we can return right away instead of passing -1 to fstatfs() and close(). This will make Coverity happy. (Coverity issue CID1371729) Signed-off-by: Greg Kurz Reviewed-by: Daniel P. berrange Reviewed-by: Eric Blake Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/9pfs/9p-local.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index 09f6a46d61b8..6d16c4a06587 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -1053,6 +1053,9 @@ static int local_statfs(FsContext *s, V9fsPath *fs_pa= th, struct statfs *stbuf) int fd, ret; =20 fd =3D local_open_nofollow(s, fs_path->data, O_RDONLY, 0); + if (fd =3D=3D -1) { + return -1; + } ret =3D fstatfs(fd, stbuf); close_preserve_errno(fd); return ret; --=20 2.7.4 From nobody Sat May 4 01:31:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1488823149146181.85774514459013; Mon, 6 Mar 2017 09:59:09 -0800 (PST) Received: from localhost ([::1]:45364 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwuY-0008MI-W0 for importer@patchew.org; Mon, 06 Mar 2017 12:59:07 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50711) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwqR-0005Qv-W3 for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ckwqO-0005fy-Po for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:52 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:53161 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ckwqO-0005ff-9a for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:48 -0500 Received: from pps.filterd (m0098413.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v26Hri6F013407 for ; Mon, 6 Mar 2017 12:54:47 -0500 Received: from e06smtp11.uk.ibm.com (e06smtp11.uk.ibm.com [195.75.94.107]) by mx0b-001b2d01.pphosted.com with ESMTP id 2917d3qyx0-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 06 Mar 2017 12:54:47 -0500 Received: from localhost by e06smtp11.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 6 Mar 2017 17:54:40 -0000 Received: from d06dlp03.portsmouth.uk.ibm.com (9.149.20.15) by e06smtp11.uk.ibm.com (192.168.101.141) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 6 Mar 2017 17:54:37 -0000 Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by d06dlp03.portsmouth.uk.ibm.com (Postfix) with ESMTP id 322EE1B08023; Mon, 6 Mar 2017 17:57:41 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06cxnps3075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v26HsaKx7799232; Mon, 6 Mar 2017 17:54:36 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BE6A84C050; Mon, 6 Mar 2017 17:54:30 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AC0B94C04E; Mon, 6 Mar 2017 17:54:30 +0000 (GMT) Received: from smtp.lab.toulouse-stg.fr.ibm.com (unknown [9.101.4.1]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Mon, 6 Mar 2017 17:54:30 +0000 (GMT) Received: from bahia.lan (icon-9-164-183-34.megacenter.de.ibm.com [9.164.183.34]) by smtp.lab.toulouse-stg.fr.ibm.com (Postfix) with ESMTP id 6EBE1220386; Mon, 6 Mar 2017 18:54:35 +0100 (CET) From: Greg Kurz To: qemu-devel@nongnu.org Date: Mon, 6 Mar 2017 18:54:08 +0100 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488822850-23070-1-git-send-email-groug@kaod.org> References: <1488822850-23070-1-git-send-email-groug@kaod.org> X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17030617-0040-0000-0000-00000356C17B X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17030617-0041-0000-0000-00001F257E7A Message-Id: <1488822850-23070-5-git-send-email-groug@kaod.org> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-06_17:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=4 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703060146 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.158.5 Subject: [Qemu-devel] [PULL 4/6] 9pfs: don't use AT_EMPTY_PATH in local_set_cred_passthrough() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Greg Kurz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The name argument can never be an empty string, and dirfd always point to the containing directory of the file name. AT_EMPTY_PATH is hence useless here. Also it breaks build with glibc version 2.13 and older. It is actually an oversight of a previous tentative patch to implement this function. We can safely drop it. Reported-by: Mark Cave-Ayland Signed-off-by: Greg Kurz Tested-by: Mark Cave-Ayland Reviewed-by: Eric Blake --- hw/9pfs/9p-local.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index 6d16c4a06587..0ca4c94ee4a8 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -349,7 +349,7 @@ static int local_set_cred_passthrough(FsContext *fs_ctx= , int dirfd, const char *name, FsCred *credp) { if (fchownat(dirfd, name, credp->fc_uid, credp->fc_gid, - AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH) < 0) { + AT_SYMLINK_NOFOLLOW) < 0) { /* * If we fail to change ownership and if we are * using security model none. Ignore the error --=20 2.7.4 From nobody Sat May 4 01:31:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 14888229577812.296660152594768; Mon, 6 Mar 2017 09:55:57 -0800 (PST) Received: from localhost ([::1]:45342 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwrU-0005Ru-Hq for importer@patchew.org; Mon, 06 Mar 2017 12:55:56 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50676) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwqO-0005Pa-Kv for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:51 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ckwqL-0005fD-Ft for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:48 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:36398 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ckwqL-0005f7-8m for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:45 -0500 Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v26HraCp063901 for ; Mon, 6 Mar 2017 12:54:43 -0500 Received: from e06smtp07.uk.ibm.com (e06smtp07.uk.ibm.com [195.75.94.103]) by mx0a-001b2d01.pphosted.com with ESMTP id 2918mm4fwt-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 06 Mar 2017 12:54:43 -0500 Received: from localhost by e06smtp07.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 6 Mar 2017 17:54:41 -0000 Received: from d06dlp01.portsmouth.uk.ibm.com (9.149.20.13) by e06smtp07.uk.ibm.com (192.168.101.137) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 6 Mar 2017 17:54:39 -0000 Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by d06dlp01.portsmouth.uk.ibm.com (Postfix) with ESMTP id 0A8D117D805F; Mon, 6 Mar 2017 17:57:55 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v26HsdgI5964252; Mon, 6 Mar 2017 17:54:39 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 90ED3AE057; Mon, 6 Mar 2017 17:54:32 +0000 (GMT) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7EAE2AE053; Mon, 6 Mar 2017 17:54:32 +0000 (GMT) Received: from smtp.lab.toulouse-stg.fr.ibm.com (unknown [9.101.4.1]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Mon, 6 Mar 2017 17:54:32 +0000 (GMT) Received: from bahia.lan (icon-9-164-183-34.megacenter.de.ibm.com [9.164.183.34]) by smtp.lab.toulouse-stg.fr.ibm.com (Postfix) with ESMTP id D6402220386; Mon, 6 Mar 2017 18:54:37 +0100 (CET) From: Greg Kurz To: qemu-devel@nongnu.org Date: Mon, 6 Mar 2017 18:54:09 +0100 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488822850-23070-1-git-send-email-groug@kaod.org> References: <1488822850-23070-1-git-send-email-groug@kaod.org> X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17030617-0028-0000-0000-000002B8D0BB X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17030617-0029-0000-0000-0000229E80B1 Message-Id: <1488822850-23070-6-git-send-email-groug@kaod.org> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-06_17:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=4 malwarescore=0 phishscore=0 adultscore=2 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703060146 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.158.5 Subject: [Qemu-devel] [PULL 5/6] 9pfs: fix O_PATH build break with older glibc versions X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Greg Kurz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" When O_PATH is used with O_DIRECTORY, it only acts as an optimization: the openat() syscall simply finds the name in the VFS, and doesn't trigger the underlying filesystem. On systems that don't define O_PATH, because they have glibc version 2.13 or older for example, we can safely omit it. We don't want to deactivate O_PATH globally though, in case it is used without O_DIRECTORY. The is done with a dedicated macro. Systems without O_PATH may thus fail to resolve names that involve unreadable directories, compared to newer systems succeeding, but such corner case failure is our only option on those older systems to avoid the security hole of chasing symlinks inappropriately. Signed-off-by: Greg Kurz Reviewed-by: Eric Blake (added last paragraph to changelog as suggested by Eric Blake) Signed-off-by: Greg Kurz --- hw/9pfs/9p-util.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h index 091f3ce88e15..cb7b2072d3ac 100644 --- a/hw/9pfs/9p-util.h +++ b/hw/9pfs/9p-util.h @@ -22,7 +22,12 @@ static inline void close_preserve_errno(int fd) =20 static inline int openat_dir(int dirfd, const char *name) { - return openat(dirfd, name, O_DIRECTORY | O_RDONLY | O_PATH); +#ifdef O_PATH +#define OPENAT_DIR_O_PATH O_PATH +#else +#define OPENAT_DIR_O_PATH 0 +#endif + return openat(dirfd, name, O_DIRECTORY | O_RDONLY | OPENAT_DIR_O_PATH); } =20 static inline int openat_file(int dirfd, const char *name, int flags, --=20 2.7.4 From nobody Sat May 4 01:31:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 148882307428147.30502856124974; Mon, 6 Mar 2017 09:57:54 -0800 (PST) Received: from localhost ([::1]:45355 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwtL-0007Pe-3I for importer@patchew.org; Mon, 06 Mar 2017 12:57:51 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50709) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ckwqR-0005Qg-Of for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ckwqO-0005fn-Is for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:51 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:53312 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ckwqO-0005fh-C2 for qemu-devel@nongnu.org; Mon, 06 Mar 2017 12:54:48 -0500 Received: from pps.filterd (m0098421.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v26Hrcre042226 for ; Mon, 6 Mar 2017 12:54:47 -0500 Received: from e06smtp07.uk.ibm.com (e06smtp07.uk.ibm.com [195.75.94.103]) by mx0a-001b2d01.pphosted.com with ESMTP id 290bhnngt8-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Mon, 06 Mar 2017 12:54:47 -0500 Received: from localhost by e06smtp07.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 6 Mar 2017 17:54:45 -0000 Received: from d06dlp01.portsmouth.uk.ibm.com (9.149.20.13) by e06smtp07.uk.ibm.com (192.168.101.137) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 6 Mar 2017 17:54:41 -0000 Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by d06dlp01.portsmouth.uk.ibm.com (Postfix) with ESMTP id 5EBD117D8056; Mon, 6 Mar 2017 17:57:57 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (d06av23.portsmouth.uk.ibm.com [9.149.105.59]) by b06cxnps4075.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v26HsfNU459218; Mon, 6 Mar 2017 17:54:41 GMT Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B37B0A4040; Mon, 6 Mar 2017 17:54:38 +0000 (GMT) Received: from d06av23.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id A071FA4051; Mon, 6 Mar 2017 17:54:38 +0000 (GMT) Received: from smtp.lab.toulouse-stg.fr.ibm.com (unknown [9.101.4.1]) by d06av23.portsmouth.uk.ibm.com (Postfix) with ESMTP; Mon, 6 Mar 2017 17:54:38 +0000 (GMT) Received: from bahia.lan (icon-9-164-183-34.megacenter.de.ibm.com [9.164.183.34]) by smtp.lab.toulouse-stg.fr.ibm.com (Postfix) with ESMTP id 5A7F6220386; Mon, 6 Mar 2017 18:54:40 +0100 (CET) From: Greg Kurz To: qemu-devel@nongnu.org Date: Mon, 6 Mar 2017 18:54:10 +0100 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1488822850-23070-1-git-send-email-groug@kaod.org> References: <1488822850-23070-1-git-send-email-groug@kaod.org> X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17030617-0028-0000-0000-000002B8D0C0 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17030617-0029-0000-0000-0000229E80B8 Message-Id: <1488822850-23070-7-git-send-email-groug@kaod.org> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-06_17:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=4 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703060146 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.158.5 Subject: [Qemu-devel] [PULL 6/6] 9pfs: fix vulnerability in openat_dir() and local_unlinkat_common() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Greg Kurz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" We should pass O_NOFOLLOW otherwise openat() will follow symlinks and make QEMU vulnerable. While here, we also fix local_unlinkat_common() to use openat_dir() for the same reasons (it was a leftover in the original patchset actually). This fixes CVE-2016-9602. Signed-off-by: Greg Kurz Reviewed-by: Daniel P. Berrange Reviewed-by: Eric Blake --- hw/9pfs/9p-local.c | 2 +- hw/9pfs/9p-util.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index 0ca4c94ee4a8..45e9a1f9b0ca 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -960,7 +960,7 @@ static int local_unlinkat_common(FsContext *ctx, int di= rfd, const char *name, if (flags =3D=3D AT_REMOVEDIR) { int fd; =20 - fd =3D openat(dirfd, name, O_RDONLY | O_DIRECTORY | O_PATH); + fd =3D openat_dir(dirfd, name); if (fd =3D=3D -1) { goto err_out; } diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h index cb7b2072d3ac..517027c52032 100644 --- a/hw/9pfs/9p-util.h +++ b/hw/9pfs/9p-util.h @@ -27,7 +27,8 @@ static inline int openat_dir(int dirfd, const char *name) #else #define OPENAT_DIR_O_PATH 0 #endif - return openat(dirfd, name, O_DIRECTORY | O_RDONLY | OPENAT_DIR_O_PATH); + return openat(dirfd, name, + O_DIRECTORY | O_RDONLY | O_NOFOLLOW | OPENAT_DIR_O_PATH); } =20 static inline int openat_file(int dirfd, const char *name, int flags, --=20 2.7.4