Re: [PATCH v4 3/3] virtiofsd: prevent opening of special files (CVE-2020-35517)

From: Stefan Hajnoczi <stefanha@redhat.com>
To: Greg Kurz <groug@kaod.org>
Cc: mszeredi@redhat.com, Daniel Berrange <berrange@redhat.com>,
	slp@redhat.com, qemu-devel@nongnu.org,
	"Dr. David Alan Gilbert" <dgilbert@redhat.com>,
	virtio-fs@redhat.com, Alex Xu <alex@alxu.ca>,
	P J P <ppandit@redhat.com>, Laszlo Ersek <lersek@redhat.com>,
	vgoyal@redhat.com
Subject: Re: [PATCH v4 3/3] virtiofsd: prevent opening of special files (CVE-2020-35517)
Date: Wed, 3 Feb 2021 17:06:32 +0000	[thread overview]
Message-ID: <20210203170632.GM74271@stefanha-x1.localdomain> (raw)
In-Reply-To: <20210203165759.352a7f64@bahia.lan>

[-- Attachment #1: Type: text/plain, Size: 1077 bytes --]

On Wed, Feb 03, 2021 at 04:57:59PM +0100, Greg Kurz wrote:
> On Wed,  3 Feb 2021 11:37:19 +0000
> Stefan Hajnoczi <stefanha@redhat.com> wrote:
> >  static int lo_do_open(struct lo_data *lo, struct lo_inode *inode,
> > -                      struct fuse_file_info *fi)
> > +                      int existing_fd, struct fuse_file_info *fi)
> >  {
> > -    char buf[64];
> >      ssize_t fh;
> > -    int fd;
> > +    int fd = existing_fd;
> >  
> >      update_open_flags(lo->writeback, lo->allow_direct_io, fi);
> >  
> > -    sprintf(buf, "%i", inode->fd);
> > -    fd = openat(lo->proc_self_fd, buf, fi->flags & ~O_NOFOLLOW);
> > -    if (fd == -1) {
> > -        return -errno;
> > +    if (fd < 0) {
> > +        fd = lo_inode_open(lo, inode, fi->flags);
> > +        if (fd == -1) {
> > +            return -errno;
> > +        }
> 
> lo_inode_open() returns a negative errno already so
> this should be converted to:
> 
>         if (fd < 0) {
>             return fd;
>         }
> 
> Apart from that LGTM.

Thanks, will fix.

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]