mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
qemu/util
History
Vitaly Chikunov e64e27d5cb 9pfs: Fix segfault in do_readdir_many caused by struct dirent overread 
`struct dirent' returned from readdir(3) could be shorter (or longer)
than `sizeof(struct dirent)', thus memcpy of sizeof length will overread
into unallocated page causing SIGSEGV. Example stack trace:

 #0  0x00005555559ebeed v9fs_co_readdir_many (/usr/bin/qemu-system-x86_64 + 0x497eed)
 #1  0x00005555559ec2e9 v9fs_readdir (/usr/bin/qemu-system-x86_64 + 0x4982e9)
 #2  0x0000555555eb7983 coroutine_trampoline (/usr/bin/qemu-system-x86_64 + 0x963983)
 #3  0x00007ffff73e0be0 n/a (n/a + 0x0)

While fixing this, provide a helper for any future `struct dirent' cloning.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/841
Cc: qemu-stable@nongnu.org
Co-authored-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Dmitry V. Levin <ldv@altlinux.org>
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
Tested-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Acked-by: Greg Kurz <groug@kaod.org>
Tested-by: Vitaly Chikunov <vt@altlinux.org>
Message-Id: <20220216181821.3481527-1-vt@altlinux.org>
[C.S. - Fix typo in source comment. ]
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
2022-02-17 16:57:58 +01:00
..
aio-posix.c
aio-posix: split poll check from ready handler
2022-01-12 17:09:39 +00:00
aio-posix.h
aio-posix: split poll check from ready handler
2022-01-12 17:09:39 +00:00
aio-wait.c
…
aio-win32.c
aio-posix: split poll check from ready handler
2022-01-12 17:09:39 +00:00
aiocb.c
…
async.c
aio-posix: split poll check from ready handler
2022-01-12 17:09:39 +00:00
atomic64.c
…
base64.c
…
bitmap.c
…
bitops.c
…
block-helpers.c
…
block-helpers.h
…
buffer.c
…
bufferiszero.c
cpuid: use unsigned for max cpuid
2022-02-04 09:07:43 -05:00
cacheflush.c
…
cacheinfo.c
…
compatfd.c
util/compatfd.c: use libc signalfd wrapper instead of raw syscall
2021-10-13 10:47:49 +02:00
coroutine-sigaltstack.c
…
coroutine-ucontext.c
…
coroutine-win32.c
…
crc32c.c
…
crc-ccitt.c
…
cutils.c
…
dbus.c
…
drm.c
…
envlist.c
…
error.c
…
event_notifier-posix.c
…
event_notifier-win32.c
…
fdmon-epoll.c
…
fdmon-io_uring.c
…
fdmon-poll.c
…
fifo8.c
…
filemonitor-inotify.c
…
filemonitor-stub.c
…
getauxval.c
…
guest-random.c
util/guest-random: Fix size arg to tail memcpy
2021-07-09 18:42:46 +02:00
hbitmap.c
…
hexdump.c
…
host-utils.c
host-utils: add 128-bit quotient support to divu128/divs128
2021-10-27 17:10:00 -07:00
id.c
…
int128.c
qemu/int128: addition of div/rem 128-bit operations
2022-01-08 15:46:10 +10:00
iov.c
…
iova-tree.c
util: Make some iova_tree parameters const
2021-11-02 15:57:21 +01:00
keyval.c
keyval: introduce keyval_parse_into
2021-07-06 08:33:51 +02:00
lockcnt.c
…
log.c
…
main-loop.c
aio-posix: split poll check from ready handler
2022-01-12 17:09:39 +00:00
memfd.c
…
meson.build
meson: reenable filemonitor-inotify compilation
2022-01-12 14:09:06 +01:00
mmap-alloc.c
Deprecate pmem=on with non-DAX capable backend file
2021-07-06 18:05:16 -04:00
module.c
modules: check arch on qom lookup
2021-07-09 18:20:27 +02:00
notify.c
…
nvdimm-utils.c
…
osdep.c
9pfs: Fix segfault in do_readdir_many caused by struct dirent overread
2022-02-17 16:57:58 +01:00
oslib-posix.c
util/oslib-posix: Fix missing unlock in the error path of os_mem_prealloc()
2022-02-06 04:33:50 -05:00
oslib-win32.c
util/oslib-win32: Fix fatal assertion in qemu_try_memalign
2021-06-19 14:51:51 -07:00
pagesize.c
…
path.c
…
qdist.c
…
qemu-co-shared-resource.c
co-shared-resource: protect with a mutex
2021-06-25 14:24:24 +03:00
qemu-config.c
qemu-config: restore "machine" in qmp_query_command_line_options()
2021-07-22 14:44:47 +02:00
qemu-coroutine-io.c
aio-posix: split poll check from ready handler
2022-01-12 17:09:39 +00:00
qemu-coroutine-lock.c
…
qemu-coroutine-sleep.c
…
qemu-coroutine.c
util: adjust coroutine pool size to virtio block queue
2022-02-14 17:11:25 +00:00
qemu-error.c
…
qemu-openpty.c
util: Remove redundant checks in the openpty()
2021-09-15 14:42:48 +02:00
qemu-option.c
qemu-option: Allow deleting opts during qemu_opts_foreach()
2021-10-15 16:11:22 +02:00
qemu-print.c
…
qemu-progress.c
…
qemu-sockets.c
build-sys: add HAVE_IPPROTO_MPTCP
2021-09-30 15:30:25 +02:00
qemu-thread-common.h
…
qemu-thread-posix.c
configure, meson: move pthread_setname_np checks to Meson
2021-10-14 09:50:57 +02:00
qemu-thread-win32.c
util: Pass file+line to qemu_rec_mutex_unlock_impl
2021-06-16 15:03:26 +02:00
qemu-timer-common.c
…
qemu-timer.c
…
qht.c
…
qsp.c
qemu/atomic: Add aligned_{int64,uint64}_t types
2021-07-21 07:45:38 -10:00
range.c
…
rcu.c
rcu: Introduce force_rcu notifier
2021-11-10 13:20:15 +01:00
readline.c
…
selfmap.c
util/selfmap: Discard mapping on error
2021-07-26 07:06:49 -10:00
stats64.c
…
sys_membarrier.c
…
systemd.c
…
thread-pool.c
…
throttle.c
…
timed-average.c
…
trace-events
modules: add tracepoints
2021-07-09 18:20:27 +02:00
trace.h
…
transactions.c
transactions: Invoke clean() after everything else
2021-11-16 09:43:44 +01:00
unicode.c
…
uri.c
util/uri: do not check argument of uri_free()
2021-07-09 12:26:05 +02:00
userfaultfd.c
…
uuid.c
…
vfio-helpers.c
util/vfio-helpers: Let qemu_vfio_do_mapping() propagate Error
2021-09-07 09:08:24 +01:00
vhost-user-server.c
block/export: Fix vhost-user-blk shutdown with requests in flight
2022-02-01 13:49:15 +01:00
yank.c
…