diff options
| author | Christian Schoenebeck <qemu_oss@crudebyte.com> | 2026-05-29 18:29:26 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-06-19 08:47:15 +0300 |
| commit | 00737c895c64a2af7295611d363d4d45a745039f (patch) | |
| tree | 4e6f246e56f68a4cc409cc7e8147ac6db98b66cf | |
| parent | 91ac2765425ecd319efa7b2b9b714d0d02a83772 (diff) | |
| download | qemu-00737c895c64a2af7295611d363d4d45a745039f.tar.gz qemu-00737c895c64a2af7295611d363d4d45a745039f.zip | |
hw/9pfs: fix abort due to illegal name with Twstat rename
The legacy Twstat 9p request can be used to rename files and directories.
Unlike the other, more recent rename requests like Trename and Trenameat,
Twstat does not validate the submitted new name before passing it to
v9fs_complete_rename().
A priviliged guest user with direct communication access to 9p server
could pass a string containing '/' as new name, which causes an assertion
fault (DoS) in local_name_to_path().
Fix this by rejecting such strings by checking the client supplied new
name with name_is_illegal(), similar to how Trename and Trenameat handlers
do already.
Reported-by: Feifan Qian <bea1e@proton.me>
Fixes: 8cf89e007a ("virtio-9p: Add P9_TWSTAT support")
Link: https://lore.kernel.org/qemu-devel/ba09716828e82992f9d8cac7f00eee0bc1c43c61.1780072238.git.qemu_oss@crudebyte.com
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
(cherry picked from commit 7f5445e7e4050cc117ed4b137bb7dd1474e49d57)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/9pfs/9p.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index b4314d2549..f84698bfcc 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3638,6 +3638,11 @@ static void coroutine_fn v9fs_wstat(void *opaque) err = -EOPNOTSUPP; goto out; } + if (name_is_illegal(v9stat.name.data)) { + err = -ENOENT; + goto out; + } + v9fs_path_write_lock(s); err = v9fs_complete_rename(pdu, fidp, -1, &v9stat.name); v9fs_path_unlock(s); |