[Qemu-commits] [qemu/qemu] 8afaae: virtiofsd: extract lo_do_open() from lo_open()

[Peter Maydell]

  Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: 8afaaee976965b7fb90ec225a51d60f35c5f173c
      
https://github.com/qemu/qemu/commit/8afaaee976965b7fb90ec225a51d60f35c5f173c
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2021-02-04 (Thu, 04 Feb 2021)

  Changed paths:
    M tools/virtiofsd/passthrough_ll.c

  Log Message:
  -----------
  virtiofsd: extract lo_do_open() from lo_open()

Both lo_open() and lo_create() have similar code to open a file. Extract
a common lo_do_open() function from lo_open() that will be used by
lo_create() in a later commit.

Since lo_do_open() does not otherwise need fuse_req_t req, convert
lo_add_fd_mapping() to use struct lo_data *lo instead.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20210204150208.367837-2-stefanha@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 22d2ece71e533310da31f2857ebc4a00d91968b3
      
https://github.com/qemu/qemu/commit/22d2ece71e533310da31f2857ebc4a00d91968b3
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2021-02-04 (Thu, 04 Feb 2021)

  Changed paths:
    M tools/virtiofsd/passthrough_ll.c

  Log Message:
  -----------
  virtiofsd: optionally return inode pointer from lo_do_lookup()

lo_do_lookup() finds an existing inode or allocates a new one. It
increments nlookup so that the inode stays alive until the client
releases it.

Existing callers don't need the struct lo_inode so the function doesn't
return it. Extend the function to optionally return the inode. The next
commit will need it.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <20210204150208.367837-3-stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: a3fdbbc7f271bff7d53d0501b29d910ece0b3789
      
https://github.com/qemu/qemu/commit/a3fdbbc7f271bff7d53d0501b29d910ece0b3789
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2021-02-04 (Thu, 04 Feb 2021)

  Changed paths:
    M tools/virtiofsd/passthrough_ll.c

  Log Message:
  -----------
  virtiofsd: prevent opening of special files (CVE-2020-35517)

A well-behaved FUSE client does not attempt to open special files with
FUSE_OPEN because they are handled on the client side (e.g. device nodes
are handled by client-side device drivers).

The check to prevent virtiofsd from opening special files is missing in
a few cases, most notably FUSE_OPEN. A malicious client can cause
virtiofsd to open a device node, potentially allowing the guest to
escape. This can be exploited by a modified guest device driver. It is
not exploitable from guest userspace since the guest kernel will handle
special files inside the guest instead of sending FUSE requests.

This patch fixes this issue by introducing the lo_inode_open() function
to check the file type before opening it. This is a short-term solution
because it does not prevent a compromised virtiofsd process from opening
device nodes on the host.

Restructure lo_create() to try O_CREAT | O_EXCL first. Note that O_CREAT
| O_EXCL does not follow symlinks, so O_NOFOLLOW masking is not
necessary here. If the file exists and the user did not specify O_EXCL,
open it via lo_do_open().

Reported-by: Alex Xu <alex@alxu.ca>
Fixes: CVE-2020-35517
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Vivek Goyal <vgoyal@redhat.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20210204150208.367837-4-stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 62124e5080e6f49f294caad60fbee26cc2d39d8f
      
https://github.com/qemu/qemu/commit/62124e5080e6f49f294caad60fbee26cc2d39d8f
  Author: Greg Kurz <groug@kaod.org>
  Date:   2021-02-04 (Thu, 04 Feb 2021)

  Changed paths:
    M tools/virtiofsd/passthrough_seccomp.c

  Log Message:
  -----------
  virtiofsd: Add _llseek to the seccomp whitelist

This is how glibc implements lseek(2) on POWER.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1917692
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <20210121171540.1449777-1-groug@kaod.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: cf269ff8032392bbdd700e7bfd21823ad9eee3a9
      
https://github.com/qemu/qemu/commit/cf269ff8032392bbdd700e7bfd21823ad9eee3a9
  Author: Greg Kurz <groug@kaod.org>
  Date:   2021-02-04 (Thu, 04 Feb 2021)

  Changed paths:
    M tools/virtiofsd/passthrough_seccomp.c

  Log Message:
  -----------
  virtiofsd: Add restart_syscall to the seccomp whitelist

This is how linux restarts some system calls after SIGSTOP/SIGCONT.
This is needed to avoid virtiofsd termination when resuming execution
under GDB for example.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <20210201193305.136390-1-groug@kaod.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 2c6df987965729df702fa12f79564b5f76e3fa4e
      
https://github.com/qemu/qemu/commit/2c6df987965729df702fa12f79564b5f76e3fa4e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2021-02-04 (Thu, 04 Feb 2021)

  Changed paths:
    M tools/virtiofsd/passthrough_ll.c
    M tools/virtiofsd/passthrough_seccomp.c

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210204' into staging

virtiofs: Security pull 2021-02-04

This contains an important CVE fix for virtiofsd,
together with two fixes for over-eager seccomp rules.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

# gpg: Signature made Thu 04 Feb 2021 18:30:37 GMT
# gpg:                using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" 
[full]
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert-gitlab/tags/pull-virtiofs-20210204:
  virtiofsd: Add restart_syscall to the seccomp whitelist
  virtiofsd: Add _llseek to the seccomp whitelist
  virtiofsd: prevent opening of special files (CVE-2020-35517)
  virtiofsd: optionally return inode pointer from lo_do_lookup()
  virtiofsd: extract lo_do_open() from lo_open()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/b749a9213ac7...2c6df9879657