From: "Dmitry V. Levin" <ldv@altlinux.org>
To: Vitaly Chikunov <vt@altlinux.org>, Greg Kurz <groug@kaod.org>
Cc: qemu-stable@nongnu.org,
"Christian Schoenebeck" <qemu_oss@crudebyte.com>,
"Philippe Mathieu-Daudé" <f4bug@amsat.org>,
qemu-devel@nongnu.org
Subject: Re: [PATCH v3] 9pfs: Fix segfault in do_readdir_many caused by struct dirent overread
Date: Fri, 4 Feb 2022 18:50:59 +0300 [thread overview]
Message-ID: <20220204155059.GA18407@altlinux.org> (raw)
In-Reply-To: <20220204153207.k2t3dwq3pdzx7bk3@altlinux.org>
On Fri, Feb 04, 2022 at 06:32:07PM +0300, Vitaly Chikunov wrote:
[...]
> > struct dirent *
> > qemu_dirent_dup(struct dirent *dent)
> > {
> > size_t sz = offsetof(struct dirent, d_name) + _D_EXACT_NAMLEN(dent) + 1;
>
> But d_namlen is not populated by synth_direntry, so this will lead to
> a bug too. Idea is that qemu_dirent_dup handles real dirents and
> simulated (underpopulated) dirents.
>
> Also Linux does not have d_namlen AFAIK, thus this code will not provide
> any speed up in most cases (and always fallback to strlen), unlike if we
> use d_reclen.
>
> Also, I m not sure if _D_EXACT_NAMLEN is defined on all systems, so this
> needs ifdefs too.
Yes, _D_EXACT_NAMLEN() is a GNU extension, it was introduced in glibc
back in 1996 but some popular libcs available for Linux do not provide
this macro.
--
ldv
next prev parent reply other threads:[~2022-02-04 15:54 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-04 5:06 [PATCH v3] 9pfs: Fix segfault in do_readdir_many caused by struct dirent overread Vitaly Chikunov
2022-02-04 12:08 ` Christian Schoenebeck
2022-02-04 12:15 ` Dmitry V. Levin
2022-02-04 12:17 ` Dmitry V. Levin
2022-02-04 13:55 ` Philippe Mathieu-Daudé via
2022-02-04 14:12 ` Christian Schoenebeck
2022-02-04 15:16 ` Greg Kurz
2022-02-04 15:32 ` Vitaly Chikunov
2022-02-04 15:50 ` Dmitry V. Levin [this message]
2022-02-04 15:54 ` Philippe Mathieu-Daudé via
2022-02-04 16:04 ` Christian Schoenebeck
2022-02-04 19:31 ` Philippe Mathieu-Daudé via
2022-02-04 15:33 ` Christian Schoenebeck
2022-02-04 16:19 ` Dmitry V. Levin
2022-02-05 3:23 ` Vitaly Chikunov
2022-02-05 5:58 ` Greg Kurz
2022-02-05 11:36 ` Christian Schoenebeck
2022-02-05 11:58 ` Philippe Mathieu-Daudé via
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220204155059.GA18407@altlinux.org \
--to=ldv@altlinux.org \
--cc=f4bug@amsat.org \
--cc=groug@kaod.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
--cc=qemu_oss@crudebyte.com \
--cc=vt@altlinux.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.