Re: [PATCH] tools/kvm_stat: fix attack vector with user controlled FUSE mounts

From: Matthias Gerstner <matthias.gerstner@suse.de>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org
Subject: Re: [PATCH] tools/kvm_stat: fix attack vector with user controlled FUSE mounts
Date: Mon, 7 Nov 2022 15:12:37 +0100	[thread overview]
Message-ID: <Y2kSVrt7sNelmvLv@kasco.suse.de> (raw)
In-Reply-To: <f308e60a-9874-429b-ace9-463fa94cb739@redhat.com>

[-- Attachment #1: Type: text/plain, Size: 1645 bytes --]

Signed-off-by: Matthias Gerstner <matthias.gerstner@suse.de>

On Sun, Nov 06, 2022 at 09:43:04AM +0100, Paolo Bonzini wrote:
> On 11/3/22 14:59, Matthias Gerstner wrote:
> > The fix is simply to use the file system type field instead. Whitespace
> > in the mount path is escaped in /proc/mounts thus no further safety
> > measures in the parsing should be necessary to make this correct.
> > ---
> >   tools/kvm/kvm_stat/kvm_stat | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> 
> Matthias, both this patch and the one you sent to linux-afs need to 
> include a "Signed-off-by" line, for example:
> 
> ###
> ###	Signed-off-by: Matthias Gerstner <matthias.gerstner@suse.de>
> ###
> 
> The meaning of this is visible at https://developercertificate.org/.
> 
> For this patch you can just reply to the message with the above line 
> (without the "###" in front) and I'll accept it.  However, for linux-afs 
> I suggest that you just resend it.  Just committing your patch with the 
> "-s" command line argument will include the line for you.
> 
> Thanks,
> 
> Paolo
> 
> > diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
> > index 9c366b3a676d..88a73999aa58 100755
> > --- a/tools/kvm/kvm_stat/kvm_stat
> > +++ b/tools/kvm/kvm_stat/kvm_stat
> > @@ -1756,7 +1756,7 @@ def assign_globals():
> >   
> >       debugfs = ''
> >       for line in open('/proc/mounts'):
> > -        if line.split(' ')[0] == 'debugfs':
> > +        if line.split(' ')[2] == 'debugfs':
> >               debugfs = line.split(' ')[1]
> >               break
> >       if debugfs == '':
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]