mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 01:43:39 +00:00
9pfs: limit xattr size in xattrcreate
We shouldn't allow guests to create extended attribute with arbitrary sizes. On linux hosts, the limit is XATTR_SIZE_MAX. Let's use it. Signed-off-by: Greg Kurz <groug@kaod.org>
This commit is contained in:
parent
7e55d65c56
commit
3b79ef2cf4
|
@ -3247,7 +3247,7 @@ static void coroutine_fn v9fs_xattrcreate(void *opaque)
|
|||
{
|
||||
int flags;
|
||||
int32_t fid;
|
||||
int64_t size;
|
||||
uint64_t size;
|
||||
ssize_t err = 0;
|
||||
V9fsString name;
|
||||
size_t offset = 7;
|
||||
|
@ -3262,6 +3262,11 @@ static void coroutine_fn v9fs_xattrcreate(void *opaque)
|
|||
}
|
||||
trace_v9fs_xattrcreate(pdu->tag, pdu->id, fid, name.data, size, flags);
|
||||
|
||||
if (size > XATTR_SIZE_MAX) {
|
||||
err = -E2BIG;
|
||||
goto out_nofid;
|
||||
}
|
||||
|
||||
file_fidp = get_fid(pdu, fid);
|
||||
if (file_fidp == NULL) {
|
||||
err = -EINVAL;
|
||||
|
|
|
@ -42,6 +42,6 @@ v9fs_mkdir(uint16_t tag, uint8_t id, int32_t fid, char* name, int mode, uint32_t
|
|||
v9fs_mkdir_return(uint16_t tag, uint8_t id, int8_t type, int32_t version, int64_t path, int err) "tag %u id %u qid={type %d version %d path %"PRId64"} err %d"
|
||||
v9fs_xattrwalk(uint16_t tag, uint8_t id, int32_t fid, int32_t newfid, char* name) "tag %d id %d fid %d newfid %d name %s"
|
||||
v9fs_xattrwalk_return(uint16_t tag, uint8_t id, int64_t size) "tag %d id %d size %"PRId64
|
||||
v9fs_xattrcreate(uint16_t tag, uint8_t id, int32_t fid, char* name, int64_t size, int flags) "tag %d id %d fid %d name %s size %"PRId64" flags %d"
|
||||
v9fs_xattrcreate(uint16_t tag, uint8_t id, int32_t fid, char* name, uint64_t size, int flags) "tag %d id %d fid %d name %s size %"PRIu64" flags %d"
|
||||
v9fs_readlink(uint16_t tag, uint8_t id, int32_t fid) "tag %d id %d fid %d"
|
||||
v9fs_readlink_return(uint16_t tag, uint8_t id, char* target) "tag %d id %d name %s"
|
||||
|
|
Loading…
Reference in a new issue