OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

virtiofsd: validate input buffer sizes in do_write_buf()

Browse Source 
There is a small change in behavior: if fuse_write_in->size doesn't
match the input buffer size then the request is failed.  Previously
write requests with 1 fuse_buf element would truncate to
fuse_write_in->size.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Sergio Lopez <slp@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
Stefan Hajnoczi 2019-02-28 11:25:32 +00:00 committed by Dr. David Alan Gilbert
parent dad157e880
commit 0ba8c3c6fc
1 changed files with 30 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
tools/virtiofsd/fuse_lowlevel.c
View File

@ -1003,8 +1003,8 @@ static void do_write(fuse_req_t req, fuse_ino_t nodeid, const void *inarg)
}
}
static void do_write_buf(fuse_req_t req, fuse_ino_t nodeid, const void *inarg,
struct fuse_bufvec *ibufv)
static void do_write_buf(fuse_req_t req, fuse_ino_t nodeid,
struct fuse_mbuf_iter *iter, struct fuse_bufvec *ibufv)
{
struct fuse_session *se = req->se;
struct fuse_bufvec *pbufv = ibufv;
@ -1012,28 +1012,27 @@ static void do_write_buf(fuse_req_t req, fuse_ino_t nodeid, const void *inarg,
.buf[0] = ibufv->buf[0],
.count = 1,
};
struct fuse_write_in *arg = (struct fuse_write_in *)inarg;
struct fuse_write_in *arg;
size_t arg_size = sizeof(*arg);
struct fuse_file_info fi;
memset(&fi, 0, sizeof(fi));
arg = fuse_mbuf_iter_advance(iter, arg_size);
if (!arg) {
fuse_reply_err(req, EINVAL);
return;
}
fi.lock_owner = arg->lock_owner;
fi.flags = arg->flags;
fi.fh = arg->fh;
fi.writepage = arg->write_flags & FUSE_WRITE_CACHE;
if (ibufv->count == 1) {
fi.lock_owner = arg->lock_owner;
fi.flags = arg->flags;
if (!(tmpbufv.buf[0].flags & FUSE_BUF_IS_FD)) {
tmpbufv.buf[0].mem = PARAM(arg);
}
tmpbufv.buf[0].size -=
sizeof(struct fuse_in_header) + sizeof(struct fuse_write_in);
if (tmpbufv.buf[0].size < arg->size) {
fuse_log(FUSE_LOG_ERR,
"fuse: do_write_buf: buffer size too small\n");
fuse_reply_err(req, EIO);
return;
}
tmpbufv.buf[0].size = arg->size;
assert(!(tmpbufv.buf[0].flags & FUSE_BUF_IS_FD));
tmpbufv.buf[0].mem = ((char *)arg) + arg_size;
tmpbufv.buf[0].size -= sizeof(struct fuse_in_header) + arg_size;
pbufv = &tmpbufv;
} else {
/*
@ -1043,6 +1042,13 @@ static void do_write_buf(fuse_req_t req, fuse_ino_t nodeid, const void *inarg,
ibufv->buf[0].size = 0;
}
if (fuse_buf_size(pbufv) != arg->size) {
fuse_log(FUSE_LOG_ERR,
"fuse: do_write_buf: buffer size doesn't match arg->size\n");
fuse_reply_err(req, EIO);
return;
}
se->op.write_buf(req, nodeid, pbufv, arg->offset, &fi);
}
@ -2052,12 +2058,17 @@ void fuse_session_process_buf_int(struct fuse_session *se,
struct fuse_chan *ch)
{
const struct fuse_buf *buf = bufv->buf;
struct fuse_mbuf_iter iter = FUSE_MBUF_ITER_INIT(buf);
struct fuse_in_header *in;
const void *inarg;
struct fuse_req *req;
int err;
in = buf->mem;
/* The first buffer must be a memory buffer */
assert(!(buf->flags & FUSE_BUF_IS_FD));
in = fuse_mbuf_iter_advance(&iter, sizeof(*in));
assert(in); /* caller guarantees the input buffer is large enough */
if (se->debug) {
fuse_log(FUSE_LOG_DEBUG,
@ -2129,7 +2140,7 @@ void fuse_session_process_buf_int(struct fuse_session *se,
inarg = (void *)&in[1];
if (in->opcode == FUSE_WRITE && se->op.write_buf) {
do_write_buf(req, in->nodeid, inarg, bufv);
do_write_buf(req, in->nodeid, &iter, bufv);
} else {
fuse_ll_ops[in->opcode].func(req, in->nodeid, inarg);
}