9pfs: handle walk of ".." in the root directory

[qemu.git] / hw / 9pfs / 9p.c

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 15fb0ab75d8e38869d2a79ba8d35a8f1ea7975f7..dfe293d11d1ca3846a0792b7aabf32277c23a929 100644 (file)
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -13,7 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/virtio/virtio.h"
 
 #include "qemu/osdep.h"
 #include "hw/virtio/virtio.h"

-#include "hw/i386/pc.h"
+#include "qapi/error.h"

 #include "qemu/error-report.h"
 #include "qemu/iov.h"
 #include "qemu/sockets.h"
 #include "qemu/error-report.h"
 #include "qemu/iov.h"
 #include "qemu/sockets.h"


@@ -231,7 +231,7 @@ static int v9fs_reopen_fid(V9fsPDU *pdu, V9fsFidState *f)
             } while (err == -EINTR && !pdu->cancelled);
         }
     } else if (f->fid_type == P9_FID_DIR) {
             } while (err == -EINTR && !pdu->cancelled);
         }
     } else if (f->fid_type == P9_FID_DIR) {

-        if (f->fs.dir == NULL) {
+        if (f->fs.dir.stream == NULL) {

             do {
                 err = v9fs_co_opendir(pdu, f);
             } while (err == -EINTR && !pdu->cancelled);
             do {
                 err = v9fs_co_opendir(pdu, f);
             } while (err == -EINTR && !pdu->cancelled);


@@ -300,6 +300,9 @@ static V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)
     f->next = s->fid_list;
     s->fid_list = f;
 
     f->next = s->fid_list;
     s->fid_list = f;
 

+    v9fs_readdir_init(&f->fs.dir);
+    v9fs_readdir_init(&f->fs_reclaim.dir);
+

     return f;
 }
 
     return f;
 }
 


@@ -345,7 +348,7 @@ static int free_fid(V9fsPDU *pdu, V9fsFidState *fidp)
             retval = v9fs_co_close(pdu, &fidp->fs);
         }
     } else if (fidp->fid_type == P9_FID_DIR) {
             retval = v9fs_co_close(pdu, &fidp->fs);
         }
     } else if (fidp->fid_type == P9_FID_DIR) {

-        if (fidp->fs.dir != NULL) {
+        if (fidp->fs.dir.stream != NULL) {

             retval = v9fs_co_closedir(pdu, &fidp->fs);
         }
     } else if (fidp->fid_type == P9_FID_XATTR) {
             retval = v9fs_co_closedir(pdu, &fidp->fs);
         }
     } else if (fidp->fid_type == P9_FID_XATTR) {


@@ -443,7 +446,7 @@ void v9fs_reclaim_fd(V9fsPDU *pdu)
                 reclaim_count++;
             }
         } else if (f->fid_type == P9_FID_DIR) {
                 reclaim_count++;
             }
         } else if (f->fid_type == P9_FID_DIR) {

-            if (f->fs.dir != NULL) {
+            if (f->fs.dir.stream != NULL) {

                 /*
                  * Up the reference count so that
                  * a clunk request won't free this fid
                 /*
                  * Up the reference count so that
                  * a clunk request won't free this fid


@@ -451,8 +454,8 @@ void v9fs_reclaim_fd(V9fsPDU *pdu)
                 f->ref++;
                 f->rclm_lst = reclaim_list;
                 reclaim_list = f;
                 f->ref++;
                 f->rclm_lst = reclaim_list;
                 reclaim_list = f;

-                f->fs_reclaim.dir = f->fs.dir;
-                f->fs.dir = NULL;
+                f->fs_reclaim.dir.stream = f->fs.dir.stream;
+                f->fs.dir.stream = NULL;

                 reclaim_count++;
             }
         }
                 reclaim_count++;
             }
         }


@@ -1007,6 +1010,7 @@ static void v9fs_attach(void *opaque)
         goto out;
     }
     err += offset;
         goto out;
     }
     err += offset;

+    memcpy(&s->root_qid, &qid, sizeof(qid));

     trace_v9fs_attach_return(pdu->tag, pdu->id,
                              qid.type, qid.version, qid.path);
     /*
     trace_v9fs_attach_return(pdu->tag, pdu->id,
                              qid.type, qid.version, qid.path);
     /*


@@ -1253,6 +1257,19 @@ static int v9fs_walk_marshal(V9fsPDU *pdu, uint16_t nwnames, V9fsQID *qids)
     return offset;
 }
 
     return offset;
 }
 

+static bool name_is_illegal(const char *name)
+{
+    return !*name || strchr(name, '/') != NULL;
+}
+
+static bool not_same_qid(const V9fsQID *qid1, const V9fsQID *qid2)
+{
+    return
+        qid1->type != qid2->type ||
+        qid1->version != qid2->version ||
+        qid1->path != qid2->path;
+}
+

 static void v9fs_walk(void *opaque)
 {
     int name_idx;
 static void v9fs_walk(void *opaque)
 {
     int name_idx;


@@ -1268,6 +1285,7 @@ static void v9fs_walk(void *opaque)
     V9fsFidState *newfidp = NULL;
     V9fsPDU *pdu = opaque;
     V9fsState *s = pdu->s;
     V9fsFidState *newfidp = NULL;
     V9fsPDU *pdu = opaque;
     V9fsState *s = pdu->s;

+    V9fsQID qid;

 
     err = pdu_unmarshal(pdu, offset, "ddw", &fid, &newfid, &nwnames);
     if (err < 0) {
 
     err = pdu_unmarshal(pdu, offset, "ddw", &fid, &newfid, &nwnames);
     if (err < 0) {


@@ -1286,6 +1304,10 @@ static void v9fs_walk(void *opaque)
             if (err < 0) {
                 goto out_nofid;
             }
             if (err < 0) {
                 goto out_nofid;
             }

+            if (name_is_illegal(wnames[i].data)) {
+                err = -ENOENT;
+                goto out_nofid;
+            }

             offset += err;
         }
     } else if (nwnames > P9_MAXWELEM) {
             offset += err;
         }
     } else if (nwnames > P9_MAXWELEM) {


@@ -1297,6 +1319,12 @@ static void v9fs_walk(void *opaque)
         err = -ENOENT;
         goto out_nofid;
     }
         err = -ENOENT;
         goto out_nofid;
     }

+
+    err = fid_to_qid(pdu, fidp, &qid);
+    if (err < 0) {
+        goto out;
+    }
+

     v9fs_path_init(&dpath);
     v9fs_path_init(&path);
     /*
     v9fs_path_init(&dpath);
     v9fs_path_init(&path);
     /*


@@ -1306,16 +1334,22 @@ static void v9fs_walk(void *opaque)
     v9fs_path_copy(&dpath, &fidp->path);
     v9fs_path_copy(&path, &fidp->path);
     for (name_idx = 0; name_idx < nwnames; name_idx++) {
     v9fs_path_copy(&dpath, &fidp->path);
     v9fs_path_copy(&path, &fidp->path);
     for (name_idx = 0; name_idx < nwnames; name_idx++) {

-        err = v9fs_co_name_to_path(pdu, &dpath, wnames[name_idx].data, &path);
-        if (err < 0) {
-            goto out;
-        }
-        err = v9fs_co_lstat(pdu, &path, &stbuf);
-        if (err < 0) {
-            goto out;
+        if (not_same_qid(&pdu->s->root_qid, &qid) ||
+            strcmp("..", wnames[name_idx].data)) {
+            err = v9fs_co_name_to_path(pdu, &dpath, wnames[name_idx].data,
+                                       &path);
+            if (err < 0) {
+                goto out;
+            }
+
+            err = v9fs_co_lstat(pdu, &path, &stbuf);
+            if (err < 0) {
+                goto out;
+            }
+            stat_to_qid(&stbuf, &qid);
+            v9fs_path_copy(&dpath, &path);

         }
         }

-        stat_to_qid(&stbuf, &qids[name_idx]);
-        v9fs_path_copy(&dpath, &path);
+        memcpy(&qids[name_idx], &qid, sizeof(qid));

     }
     if (fid == newfid) {
         BUG_ON(fidp->fid_type != P9_FID_NONE);
     }
     if (fid == newfid) {
         BUG_ON(fidp->fid_type != P9_FID_NONE);


@@ -1480,6 +1514,16 @@ static void v9fs_lcreate(void *opaque)
     }
     trace_v9fs_lcreate(pdu->tag, pdu->id, dfid, flags, mode, gid);
 
     }
     trace_v9fs_lcreate(pdu->tag, pdu->id, dfid, flags, mode, gid);
 

+    if (name_is_illegal(name.data)) {
+        err = -ENOENT;
+        goto out_nofid;
+    }
+
+    if (!strcmp(".", name.data) || !strcmp("..", name.data)) {
+        err = -EEXIST;
+        goto out_nofid;
+    }
+

     fidp = get_fid(pdu, dfid);
     if (fidp == NULL) {
         err = -ENOENT;
     fidp = get_fid(pdu, dfid);
     if (fidp == NULL) {
         err = -ENOENT;


@@ -1587,7 +1631,7 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp,
     int read_count;
     int64_t xattr_len;
     V9fsVirtioState *v = container_of(s, V9fsVirtioState, state);
     int read_count;
     int64_t xattr_len;
     V9fsVirtioState *v = container_of(s, V9fsVirtioState, state);

-    VirtQueueElement *elem = &v->elems[pdu->idx];
+    VirtQueueElement *elem = v->elems[pdu->idx];

 
     xattr_len = fidp->fs.xattr.len;
     read_count = xattr_len - off;
 
     xattr_len = fidp->fs.xattr.len;
     read_count = xattr_len - off;


@@ -1624,7 +1668,7 @@ static int v9fs_do_readdir_with_stat(V9fsPDU *pdu,
     int32_t count = 0;
     struct stat stbuf;
     off_t saved_dir_pos;
     int32_t count = 0;
     struct stat stbuf;
     off_t saved_dir_pos;

-    struct dirent *dent, *result;
+    struct dirent *dent;

 
     /* save the directory position */
     saved_dir_pos = v9fs_co_telldir(pdu, fidp);
 
     /* save the directory position */
     saved_dir_pos = v9fs_co_telldir(pdu, fidp);


@@ -1632,34 +1676,37 @@ static int v9fs_do_readdir_with_stat(V9fsPDU *pdu,
         return saved_dir_pos;
     }
 
         return saved_dir_pos;
     }
 

-    dent = g_malloc(sizeof(struct dirent));
-

     while (1) {
         v9fs_path_init(&path);
     while (1) {
         v9fs_path_init(&path);

-        err = v9fs_co_readdir_r(pdu, fidp, dent, &result);
-        if (err || !result) {
+
+        v9fs_readdir_lock(&fidp->fs.dir);
+
+        err = v9fs_co_readdir(pdu, fidp, &dent);
+        if (err || !dent) {

             break;
         }
         err = v9fs_co_name_to_path(pdu, &fidp->path, dent->d_name, &path);
         if (err < 0) {
             break;
         }
         err = v9fs_co_name_to_path(pdu, &fidp->path, dent->d_name, &path);
         if (err < 0) {

-            goto out;
+            break;

         }
         err = v9fs_co_lstat(pdu, &path, &stbuf);
         if (err < 0) {
         }
         err = v9fs_co_lstat(pdu, &path, &stbuf);
         if (err < 0) {

-            goto out;
+            break;

         }
         err = stat_to_v9stat(pdu, &path, &stbuf, &v9stat);
         if (err < 0) {
         }
         err = stat_to_v9stat(pdu, &path, &stbuf, &v9stat);
         if (err < 0) {

-            goto out;
+            break;

         }
         /* 11 = 7 + 4 (7 = start offset, 4 = space for storing count) */
         len = pdu_marshal(pdu, 11 + count, "S", &v9stat);
         }
         /* 11 = 7 + 4 (7 = start offset, 4 = space for storing count) */
         len = pdu_marshal(pdu, 11 + count, "S", &v9stat);

+
+        v9fs_readdir_unlock(&fidp->fs.dir);
+

         if ((len != (v9stat.size + 2)) || ((count + len) > max_count)) {
             /* Ran out of buffer. Set dir back to old position and return */
             v9fs_co_seekdir(pdu, fidp, saved_dir_pos);
             v9fs_stat_free(&v9stat);
             v9fs_path_free(&path);
         if ((len != (v9stat.size + 2)) || ((count + len) > max_count)) {
             /* Ran out of buffer. Set dir back to old position and return */
             v9fs_co_seekdir(pdu, fidp, saved_dir_pos);
             v9fs_stat_free(&v9stat);
             v9fs_path_free(&path);

-            g_free(dent);

             return count;
         }
         count += len;
             return count;
         }
         count += len;


@@ -1667,8 +1714,9 @@ static int v9fs_do_readdir_with_stat(V9fsPDU *pdu,
         v9fs_path_free(&path);
         saved_dir_pos = dent->d_off;
     }
         v9fs_path_free(&path);
         saved_dir_pos = dent->d_off;
     }

-out:
-    g_free(dent);
+
+    v9fs_readdir_unlock(&fidp->fs.dir);
+

     v9fs_path_free(&path);
     if (err < 0) {
         return err;
     v9fs_path_free(&path);
     if (err < 0) {
         return err;


@@ -1804,7 +1852,7 @@ static int v9fs_do_readdir(V9fsPDU *pdu,
     int len, err = 0;
     int32_t count = 0;
     off_t saved_dir_pos;
     int len, err = 0;
     int32_t count = 0;
     off_t saved_dir_pos;

-    struct dirent *dent, *result;
+    struct dirent *dent;

 
     /* save the directory position */
     saved_dir_pos = v9fs_co_telldir(pdu, fidp);
 
     /* save the directory position */
     saved_dir_pos = v9fs_co_telldir(pdu, fidp);


@@ -1812,20 +1860,21 @@ static int v9fs_do_readdir(V9fsPDU *pdu,
         return saved_dir_pos;
     }
 
         return saved_dir_pos;
     }
 

-    dent = g_malloc(sizeof(struct dirent));
-

     while (1) {
     while (1) {

-        err = v9fs_co_readdir_r(pdu, fidp, dent, &result);
-        if (err || !result) {
+        v9fs_readdir_lock(&fidp->fs.dir);
+
+        err = v9fs_co_readdir(pdu, fidp, &dent);
+        if (err || !dent) {

             break;
         }
         v9fs_string_init(&name);
         v9fs_string_sprintf(&name, "%s", dent->d_name);
         if ((count + v9fs_readdir_data_size(&name)) > max_count) {
             break;
         }
         v9fs_string_init(&name);
         v9fs_string_sprintf(&name, "%s", dent->d_name);
         if ((count + v9fs_readdir_data_size(&name)) > max_count) {

+            v9fs_readdir_unlock(&fidp->fs.dir);
+

             /* Ran out of buffer. Set dir back to old position and return */
             v9fs_co_seekdir(pdu, fidp, saved_dir_pos);
             v9fs_string_free(&name);
             /* Ran out of buffer. Set dir back to old position and return */
             v9fs_co_seekdir(pdu, fidp, saved_dir_pos);
             v9fs_string_free(&name);

-            g_free(dent);

             return count;
         }
         /*
             return count;
         }
         /*


@@ -1843,17 +1892,21 @@ static int v9fs_do_readdir(V9fsPDU *pdu,
         len = pdu_marshal(pdu, 11 + count, "Qqbs",
                           &qid, dent->d_off,
                           dent->d_type, &name);
         len = pdu_marshal(pdu, 11 + count, "Qqbs",
                           &qid, dent->d_off,
                           dent->d_type, &name);

+
+        v9fs_readdir_unlock(&fidp->fs.dir);
+

         if (len < 0) {
             v9fs_co_seekdir(pdu, fidp, saved_dir_pos);
             v9fs_string_free(&name);
         if (len < 0) {
             v9fs_co_seekdir(pdu, fidp, saved_dir_pos);
             v9fs_string_free(&name);

-            g_free(dent);

             return len;
         }
         count += len;
         v9fs_string_free(&name);
         saved_dir_pos = dent->d_off;
     }
             return len;
         }
         count += len;
         v9fs_string_free(&name);
         saved_dir_pos = dent->d_off;
     }

-    g_free(dent);
+
+    v9fs_readdir_unlock(&fidp->fs.dir);
+

     if (err < 0) {
         return err;
     }
     if (err < 0) {
         return err;
     }


@@ -1883,7 +1936,7 @@ static void v9fs_readdir(void *opaque)
         retval = -EINVAL;
         goto out_nofid;
     }
         retval = -EINVAL;
         goto out_nofid;
     }

-    if (!fidp->fs.dir) {
+    if (!fidp->fs.dir.stream) {

         retval = -EINVAL;
         goto out;
     }
         retval = -EINVAL;
         goto out;
     }


@@ -2065,6 +2118,16 @@ static void v9fs_create(void *opaque)
     }
     trace_v9fs_create(pdu->tag, pdu->id, fid, name.data, perm, mode);
 
     }
     trace_v9fs_create(pdu->tag, pdu->id, fid, name.data, perm, mode);
 

+    if (name_is_illegal(name.data)) {
+        err = -ENOENT;
+        goto out_nofid;
+    }
+
+    if (!strcmp(".", name.data) || !strcmp("..", name.data)) {
+        err = -EEXIST;
+        goto out_nofid;
+    }
+

     fidp = get_fid(pdu, fid);
     if (fidp == NULL) {
         err = -EINVAL;
     fidp = get_fid(pdu, fid);
     if (fidp == NULL) {
         err = -EINVAL;


@@ -2230,6 +2293,16 @@ static void v9fs_symlink(void *opaque)
     }
     trace_v9fs_symlink(pdu->tag, pdu->id, dfid, name.data, symname.data, gid);
 
     }
     trace_v9fs_symlink(pdu->tag, pdu->id, dfid, name.data, symname.data, gid);
 

+    if (name_is_illegal(name.data)) {
+        err = -ENOENT;
+        goto out_nofid;
+    }
+
+    if (!strcmp(".", name.data) || !strcmp("..", name.data)) {
+        err = -EEXIST;
+        goto out_nofid;
+    }
+

     dfidp = get_fid(pdu, dfid);
     if (dfidp == NULL) {
         err = -EINVAL;
     dfidp = get_fid(pdu, dfid);
     if (dfidp == NULL) {
         err = -EINVAL;


@@ -2304,6 +2377,16 @@ static void v9fs_link(void *opaque)
     }
     trace_v9fs_link(pdu->tag, pdu->id, dfid, oldfid, name.data);
 
     }
     trace_v9fs_link(pdu->tag, pdu->id, dfid, oldfid, name.data);
 

+    if (name_is_illegal(name.data)) {
+        err = -ENOENT;
+        goto out_nofid;
+    }
+
+    if (!strcmp(".", name.data) || !strcmp("..", name.data)) {
+        err = -EEXIST;
+        goto out_nofid;
+    }
+

     dfidp = get_fid(pdu, dfid);
     if (dfidp == NULL) {
         err = -ENOENT;
     dfidp = get_fid(pdu, dfid);
     if (dfidp == NULL) {
         err = -ENOENT;


@@ -2386,6 +2469,22 @@ static void v9fs_unlinkat(void *opaque)
     if (err < 0) {
         goto out_nofid;
     }
     if (err < 0) {
         goto out_nofid;
     }

+
+    if (name_is_illegal(name.data)) {
+        err = -ENOENT;
+        goto out_nofid;
+    }
+
+    if (!strcmp(".", name.data)) {
+        err = -EINVAL;
+        goto out_nofid;
+    }
+
+    if (!strcmp("..", name.data)) {
+        err = -ENOTEMPTY;
+        goto out_nofid;
+    }
+

     dfidp = get_fid(pdu, dfid);
     if (dfidp == NULL) {
         err = -EINVAL;
     dfidp = get_fid(pdu, dfid);
     if (dfidp == NULL) {
         err = -EINVAL;


@@ -2492,6 +2591,17 @@ static void v9fs_rename(void *opaque)
     if (err < 0) {
         goto out_nofid;
     }
     if (err < 0) {
         goto out_nofid;
     }

+
+    if (name_is_illegal(name.data)) {
+        err = -ENOENT;
+        goto out_nofid;
+    }
+
+    if (!strcmp(".", name.data) || !strcmp("..", name.data)) {
+        err = -EISDIR;
+        goto out_nofid;
+    }
+

     fidp = get_fid(pdu, fid);
     if (fidp == NULL) {
         err = -ENOENT;
     fidp = get_fid(pdu, fid);
     if (fidp == NULL) {
         err = -ENOENT;


@@ -2604,6 +2714,17 @@ static void v9fs_renameat(void *opaque)
         goto out_err;
     }
 
         goto out_err;
     }
 

+    if (name_is_illegal(old_name.data) || name_is_illegal(new_name.data)) {
+        err = -ENOENT;
+        goto out_err;
+    }
+
+    if (!strcmp(".", old_name.data) || !strcmp("..", old_name.data) ||
+        !strcmp(".", new_name.data) || !strcmp("..", new_name.data)) {
+        err = -EISDIR;
+        goto out_err;
+    }
+

     v9fs_path_write_lock(s);
     err = v9fs_complete_renameat(pdu, olddirfid,
                                  &old_name, newdirfid, &new_name);
     v9fs_path_write_lock(s);
     err = v9fs_complete_renameat(pdu, olddirfid,
                                  &old_name, newdirfid, &new_name);


@@ -2814,6 +2935,16 @@ static void v9fs_mknod(void *opaque)
     }
     trace_v9fs_mknod(pdu->tag, pdu->id, fid, mode, major, minor);
 
     }
     trace_v9fs_mknod(pdu->tag, pdu->id, fid, mode, major, minor);
 

+    if (name_is_illegal(name.data)) {
+        err = -ENOENT;
+        goto out_nofid;
+    }
+
+    if (!strcmp(".", name.data) || !strcmp("..", name.data)) {
+        err = -EEXIST;
+        goto out_nofid;
+    }
+

     fidp = get_fid(pdu, fid);
     if (fidp == NULL) {
         err = -ENOENT;
     fidp = get_fid(pdu, fid);
     if (fidp == NULL) {
         err = -ENOENT;


@@ -2965,6 +3096,16 @@ static void v9fs_mkdir(void *opaque)
     }
     trace_v9fs_mkdir(pdu->tag, pdu->id, fid, name.data, mode, gid);
 
     }
     trace_v9fs_mkdir(pdu->tag, pdu->id, fid, name.data, mode, gid);
 

+    if (name_is_illegal(name.data)) {
+        err = -ENOENT;
+        goto out_nofid;
+    }
+
+    if (!strcmp(".", name.data) || !strcmp("..", name.data)) {
+        err = -EEXIST;
+        goto out_nofid;
+    }
+

     fidp = get_fid(pdu, fid);
     if (fidp == NULL) {
         err = -ENOENT;
     fidp = get_fid(pdu, fid);
     if (fidp == NULL) {
         err = -ENOENT;


@@ -3266,8 +3407,8 @@ void pdu_submit(V9fsPDU *pdu)
     if (is_ro_export(&s->ctx) && !is_read_only_op(pdu)) {
         handler = v9fs_fs_ro;
     }
     if (is_ro_export(&s->ctx) && !is_read_only_op(pdu)) {
         handler = v9fs_fs_ro;
     }

-    co = qemu_coroutine_create(handler);
-    qemu_coroutine_enter(co, pdu);
+    co = qemu_coroutine_create(handler, pdu);
+    qemu_coroutine_enter(co);

 }
 
 /* Returns 0 on success, 1 on failure. */
 }
 
 /* Returns 0 on success, 1 on failure. */