]> xenbits.xensource.com Git - qemu-xen.git/commit
9p: take write lock on fid path updates (CVE-2018-19364)
authorGreg Kurz <groug@kaod.org>
Tue, 20 Nov 2018 12:00:35 +0000 (13:00 +0100)
committerAnthony PERARD <anthony.perard@citrix.com>
Tue, 2 Apr 2019 16:27:33 +0000 (17:27 +0100)
commit759d77d0395b59cc05943f83ba648830d6d35e52
tree1dd2ad5b1b2a0f82a423ac249ea6f26d67564a9c
parentaf88bba0d28a489e713676fb7925f331c63e58ab
9p: take write lock on fid path updates (CVE-2018-19364)

Recent commit 5b76ef50f62079a fixed a race where v9fs_co_open2() could
possibly overwrite a fid path with v9fs_path_copy() while it is being
accessed by some other thread, ie, use-after-free that can be detected
by ASAN with a custom 9p client.

It turns out that the same can happen at several locations where
v9fs_path_copy() is used to set the fid path. The fix is again to
take the write lock.

Fixes CVE-2018-19364.

Cc: P J P <ppandit@redhat.com>
Reported-by: zhibin hu <noirfate@gmail.com>
Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
(cherry picked from commit 5b3c77aa581ebb215125c84b0742119483571e55)
hw/9pfs/9p.c