diff options
| author | Christian Schoenebeck <qemu_oss@crudebyte.com> | 2026-05-29 18:29:40 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-06-19 08:47:15 +0300 |
| commit | 97455be94191df1399dae35b1c2ba5b957ead949 (patch) | |
| tree | d6d70ed4a3cc938e6d52d208f052271f6591ce75 | |
| parent | 13fb03237629a595f6a8ea9c5c1d99f605c948c3 (diff) | |
| download | qemu-97455be94191df1399dae35b1c2ba5b957ead949.tar.gz qemu-97455be94191df1399dae35b1c2ba5b957ead949.zip | |
hw/9pfs: reject . and .. in Twstat rename
The other Trename and Trenameat handlers already reject "." and ".."
as new name on rename requests by returning -EISDIR in this case.
The legacy Twstat rename handler is missing this validation. While passing
"." or ".." does not trigger a crash as fixed by the previous patch (since
the fs backend driver's system calls handle these gracefully), it creates
a behavioral inconsistency, as it is semantically meaningless to rename a
file to a directory reference in the first place.
Fix this by rejecting "." and ".." in Twstat rename handler with -EISDIR
to match behavior of Trename and Trenameat handlers.
Fixes: 8cf89e007a ("virtio-9p: Add P9_TWSTAT support")
Link: https://lore.kernel.org/qemu-devel/662333331d371c6c343c8091161de8eaa121880e.1780072238.git.qemu_oss@crudebyte.com
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
(cherry picked from commit 08750e31fcdccf5352dc3b44475ed5ba6bc80221)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/9pfs/9p.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 7c65d4f7d1..abc54e169c 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3642,6 +3642,10 @@ static void coroutine_fn v9fs_wstat(void *opaque) err = -ENOENT; goto out; } + if (!strcmp(".", v9stat.name.data) || !strcmp("..", v9stat.name.data)) { + err = -EISDIR; + goto out; + } v9fs_path_write_lock(s); err = v9fs_complete_rename(pdu, fidp, -1, &v9stat.name); |