diff options
author | Greg Kurz <groug@kaod.org> | 2017-02-26 23:43:25 +0100 |
---|---|---|
committer | Greg Kurz <groug@kaod.org> | 2017-02-28 11:21:15 +0100 |
commit | 31e51d1c15b35dc98b88a301812914b70a2b55dc (patch) | |
tree | f1bdaeddcf8ca308a79fb74d409e454b5ea5e3b8 /hw/9pfs/9p-local.c | |
parent | a33eda0dd99e00faa3bacae43d19490bb9500e07 (diff) | |
download | qemu-31e51d1c15b35dc98b88a301812914b70a2b55dc.zip qemu-31e51d1c15b35dc98b88a301812914b70a2b55dc.tar.gz qemu-31e51d1c15b35dc98b88a301812914b70a2b55dc.tar.bz2 |
9pfs: local: statfs: don't follow symlinks
The local_statfs() callback is vulnerable to symlink attacks because it
calls statfs() which follows symbolic links in all path elements.
This patch converts local_statfs() to rely on open_nofollow() and fstatfs()
instead.
This partly fixes CVE-2016-9602.
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw/9pfs/9p-local.c')
-rw-r--r-- | hw/9pfs/9p-local.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index a6dd77d..95b2c1c 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -1077,13 +1077,11 @@ static int local_fsync(FsContext *ctx, int fid_type, static int local_statfs(FsContext *s, V9fsPath *fs_path, struct statfs *stbuf) { - char *buffer; - int ret; - char *path = fs_path->data; + int fd, ret; - buffer = rpath(s, path); - ret = statfs(buffer, stbuf); - g_free(buffer); + fd = local_open_nofollow(s, fs_path->data, O_RDONLY, 0); + ret = fstatfs(fd, stbuf); + close_preserve_errno(fd); return ret; } |