diff options
| author | Christian Schoenebeck <qemu_oss@crudebyte.com> | 2026-05-29 18:29:40 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-06-19 08:47:15 +0300 |
| commit | a7f9127b5978ea1e6ed1bdbc8d1c874cea9221b8 (patch) | |
| tree | dbea1e9a03bea41ec40e756c84b8ec27218ef4cc | |
| parent | 00737c895c64a2af7295611d363d4d45a745039f (diff) | |
| download | qemu-a7f9127b5978ea1e6ed1bdbc8d1c874cea9221b8.tar.gz qemu-a7f9127b5978ea1e6ed1bdbc8d1c874cea9221b8.zip | |
hw/9pfs: reject . and .. in Twstat rename
The other Trename and Trenameat handlers already reject "." and ".."
as new name on rename requests by returning -EISDIR in this case.
The legacy Twstat rename handler is missing this validation. While passing
"." or ".." does not trigger a crash as fixed by the previous patch (since
the fs backend driver's system calls handle these gracefully), it creates
a behavioral inconsistency, as it is semantically meaningless to rename a
file to a directory reference in the first place.
Fix this by rejecting "." and ".." in Twstat rename handler with -EISDIR
to match behavior of Trename and Trenameat handlers.
Fixes: 8cf89e007a ("virtio-9p: Add P9_TWSTAT support")
Link: https://lore.kernel.org/qemu-devel/662333331d371c6c343c8091161de8eaa121880e.1780072238.git.qemu_oss@crudebyte.com
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
(cherry picked from commit 08750e31fcdccf5352dc3b44475ed5ba6bc80221)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/9pfs/9p.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index f84698bfcc..936e4e9349 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3642,6 +3642,10 @@ static void coroutine_fn v9fs_wstat(void *opaque) err = -ENOENT; goto out; } + if (!strcmp(".", v9stat.name.data) || !strcmp("..", v9stat.name.data)) { + err = -EISDIR; + goto out; + } v9fs_path_write_lock(s); err = v9fs_complete_rename(pdu, fidp, -1, &v9stat.name); |