[13/25] virtiofsd: prevent ".." escape in lo_do_lookup()

Commit Message

Dr. David Alan Gilbert Oct. 24, 2019, 11:27 a.m. UTC

From: Stefan Hajnoczi <[e-mail]>

Signed-off-by: Stefan Hajnoczi <[e-mail]>
---
 contrib/virtiofsd/passthrough_ll.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

Patch

diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c
index 702fedc38a..7a61bf94fe 100644
--- a/contrib/virtiofsd/passthrough_ll.c
+++ b/contrib/virtiofsd/passthrough_ll.c
@@ -606,12 +606,17 @@  static int lo_do_lookup(fuse_req_t req, fuse_ino_t parent, const char *name,
 	int res;
 	int saverr;
 	struct lo_data *lo = lo_data(req);
-	struct lo_inode *inode;
+	struct lo_inode *inode, *dir = lo_inode(req, parent);
 
 	memset(e, 0, sizeof(*e));
 	e->attr_timeout = lo->timeout;
 	e->entry_timeout = lo->timeout;
 
+	/* Do not allow escaping root directory */
+	if (dir == &lo->root && strcmp(name, "..") == 0) {
+		name = ".";
+	}
+
 	newfd = openat(lo_fd(req, parent), name, O_PATH | O_NOFOLLOW);
 	if (newfd == -1)
 		goto out_err;