[Qemu-commits] [qemu/qemu] 5b76ef: 9p: write lock path in v9fs_co_open2()

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 5b76ef50f62079a2389ba28cacaf6cce68b1a0ed
      
https://github.com/qemu/qemu/commit/5b76ef50f62079a2389ba28cacaf6cce68b1a0ed
  Author: Greg Kurz <address@hidden>
  Date:   2018-11-08 (Thu, 08 Nov 2018)

  Changed paths:
    M hw/9pfs/cofile.c

  Log Message:
  -----------
  9p: write lock path in v9fs_co_open2()

The assumption that the fid cannot be used by any other operation is
wrong. At least, nothing prevents a misbehaving client to create a
file with a given fid, and to pass this fid to some other operation
at the same time (ie, without waiting for the response to the creation
request). The call to v9fs_path_copy() performed by the worker thread
after the file was created can race with any access to the fid path
performed by some other thread. This causes use-after-free issues that
can be detected by ASAN with a custom 9p client.

Unlike other operations that only read the fid path, v9fs_co_open2()
does modify it. It should hence take the write lock.

Cc: P J P <address@hidden>
Reported-by: zhibin hu <address@hidden>
Signed-off-by: Greg Kurz <address@hidden>


  Commit: 160e5c22e55b3f775c2003dfc626fa872ee4a7a1
      
https://github.com/qemu/qemu/commit/160e5c22e55b3f775c2003dfc626fa872ee4a7a1
  Author: Peter Maydell <address@hidden>
  Date:   2018-11-09 (Fri, 09 Nov 2018)

  Changed paths:
    M hw/9pfs/cofile.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging

Fixes a potential use-after-free issue that could be triggered by a
misbehaving guest.

# gpg: Signature made Thu 08 Nov 2018 20:36:48 GMT
# gpg:                using RSA key 71D4D5E5822F73D6
# gpg: Good signature from "Greg Kurz <address@hidden>"
# gpg:                 aka "Gregory Kurz <address@hidden>"
# gpg:                 aka "[jpeg image of size 3330]"
# Primary key fingerprint: B482 8BAF 9431 40CE F2A3  4910 71D4 D5E5 822F 73D6

* remotes/gkurz/tags/for-upstream:
  9p: write lock path in v9fs_co_open2()

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/d3c2bbb166f8...160e5c22e55b
      **NOTE:** This service has been marked for deprecation: 
https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.