Commit 49dd946b authored by Greg Kurz's avatar Greg Kurz
Browse files

9pfs: don't BUG_ON() if fid is already opened 



A buggy or malicious guest could pass the id of an already opened fid and
cause QEMU to abort. Let's return EINVAL to the guest instead.

Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
Reviewed-by: default avatarEric Blake <eblake@redhat.com>
parent dd654e03

hw/9pfs/9p.c

+16 −4
Original line number Diff line number Diff line
@@ -1361,7 +1361,10 @@ static void coroutine_fn v9fs_walk(void *opaque) 
        memcpy(&qids[name_idx], &qid, sizeof(qid));

    }

    if (fid == newfid) {

        BUG_ON(fidp->fid_type != P9_FID_NONE);

        if (fidp->fid_type != P9_FID_NONE) {

            err = -EINVAL;

            goto out;

        }

        v9fs_path_copy(&fidp->path, &path);

    } else {

        newfidp = alloc_fid(s, newfid);
@@ -1443,7 +1446,10 @@ static void coroutine_fn v9fs_open(void *opaque) 
        err = -ENOENT;

        goto out_nofid;

    }

    BUG_ON(fidp->fid_type != P9_FID_NONE);

    if (fidp->fid_type != P9_FID_NONE) {

        err = -EINVAL;

        goto out;

    }



    err = v9fs_co_lstat(pdu, &fidp->path, &stbuf);

    if (err < 0) {
@@ -2540,7 +2546,10 @@ static int coroutine_fn v9fs_complete_rename(V9fsPDU *pdu, V9fsFidState *fidp, 
            err = -ENOENT;

            goto out_nofid;

        }

        BUG_ON(dirfidp->fid_type != P9_FID_NONE);

        if (fidp->fid_type != P9_FID_NONE) {

            err = -EINVAL;

            goto out;

        }

        v9fs_co_name_to_path(pdu, &dirfidp->path, name->data, &new_path);

    } else {

        old_name = fidp->path.data;
@@ -2612,7 +2621,10 @@ static void coroutine_fn v9fs_rename(void *opaque) 
        err = -ENOENT;

        goto out_nofid;

    }

    BUG_ON(fidp->fid_type != P9_FID_NONE);

    if (fidp->fid_type != P9_FID_NONE) {

        err = -EINVAL;

        goto out;

    }

    /* if fs driver is not path based, return EOPNOTSUPP */

    if (!(pdu->s->ctx.export_flags & V9FS_PATHNAME_FSCONTEXT)) {

        err = -EOPNOTSUPP;