Skip to content

Q
qemu

openeuler / qemu

通知 10
Star 0
Fork 0
Q
qemu

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 08 6月, 2019 1 次提交
  3. 02 5月, 2019 3 次提交
  5. 17 4月, 2019 1 次提交
  7. 02 4月, 2019 3 次提交
    • D
      filemon: fix watch IDs to avoid potential wraparound issues · b4682a63
      由 Daniel P. Berrangé 提交于 
      Watch IDs are allocated from incrementing a int counter against
the QFileMonitor object. In very long life QEMU processes with
a huge amount of USB MTP activity creating & deleting directories
it is just about conceivable that the int counter can wrap
around. This would result in incorrect behaviour of the file
monitor watch APIs due to clashing watch IDs.

Instead of trying to detect this situation, this patch changes
the way watch IDs are allocated. It is turned into an int64_t
variable where the high 32 bits are set from the underlying
inotify "int" ID. This gives an ID that is guaranteed unique
for the directory as a whole, and we can rely on the kernel
to enforce this. QFileMonitor then sets the low 32 bits from
a per-directory counter.

The USB MTP device only sets watches on the directory as a
whole, not files within, so there is no risk of guest
triggered wrap around on the low 32 bits.
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>
      b4682a63
    • B
      usb-mtp: remove usb_mtp_object_free_one · b396733d
      由 Bandan Das 提交于 
      This function is used in the delete path only and can
be replaced by a call to usb_mtp_object_free.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBandan Das <bsd@redhat.com>
Message-Id: <20190401211712.19012-3-bsd@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      b396733d
    • B
      usb-mtp: fix return status of delete · 4bc15916
      由 Bandan Das 提交于 
      Spotted by Coverity: CID 1399414

mtp delete allows the return status of delete succeeded,
partial_delete or readonly - when none of the objects could be
deleted. Give more meaningful names to return values of the
delete function.

Some initiators recurse over the objects themselves. In that case,
only READ_ONLY can be returned.
Signed-off-by: NBandan Das <bsd@redhat.com>
Message-Id: <20190401211712.19012-2-bsd@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      4bc15916
  9. 07 3月, 2019 3 次提交
  11. 26 2月, 2019 3 次提交
  13. 30 1月, 2019 4 次提交
  15. 11 1月, 2019 1 次提交
  17. 08 1月, 2019 1 次提交
  19. 14 12月, 2018 2 次提交
    • M
      usb-mtp: Limit filename to object information size · 90c1a742
      由 Michael Hanselmann 提交于 
      The filename length in MTP metadata is specified by the guest. By
trusting it directly it'd theoretically be possible to get the host to
write memory parts outside the filename buffer into a filename. In
practice though there are usually NUL bytes stopping the string
operations.

Also use the opportunity to not assign the filename member twice.
Signed-off-by: NMichael Hanselmann <public@hansmi.ch>
Message-id: ab70659d8d5c580bdf150a5f7d5cc60c8e374ffc.1544740018.git.public@hansmi.ch

[ kraxel: codestyle fix: break a long line ]
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      90c1a742
    • G
      usb-mtp: use O_NOFOLLOW and O_CLOEXEC. · bab9df35
      由 Gerd Hoffmann 提交于 
      Open files and directories with O_NOFOLLOW to avoid symlinks attacks.
While being at it also add O_CLOEXEC.

usb-mtp only handles regular files and directories and ignores
everything else, so users should not see a difference.

Because qemu ignores symlinks, carrying out a successful symlink attack
requires swapping an existing file or directory below rootdir for a
symlink and winning the race against the inotify notification to qemu.

Fixes: CVE-2018-16872
Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: Bandan Das <bsd@redhat.com>
Reported-by: NMichael Hanselmann <public@hansmi.ch>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NMichael Hanselmann <public@hansmi.ch>
Message-id: 20181213122511.13853-1-kraxel@redhat.com
      bab9df35
  21. 04 12月, 2018 2 次提交
  23. 01 10月, 2018 2 次提交
  25. 21 8月, 2018 5 次提交
  27. 12 6月, 2018 2 次提交
  29. 02 6月, 2018 1 次提交
  31. 07 5月, 2018 2 次提交
  33. 26 2月, 2018 4 次提交