From patchwork Wed Mar 6 21:04:07 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bandan Das X-Patchwork-Id: 10841737 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 58D62922 for ; Wed, 6 Mar 2019 21:12:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 47BAB2E8DD for ; Wed, 6 Mar 2019 21:12:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3C82A2EF20; Wed, 6 Mar 2019 21:12:26 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 3BB8F2EF3E for ; Wed, 6 Mar 2019 21:12:23 +0000 (UTC) Received: from localhost ([127.0.0.1]:39629 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h1dpu-0006CJ-FE for patchwork-qemu-devel@patchwork.kernel.org; Wed, 06 Mar 2019 16:12:22 -0500 Received: from eggs.gnu.org ([209.51.188.92]:52619) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h1dor-0005bU-MP for qemu-devel@nongnu.org; Wed, 06 Mar 2019 16:11:18 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1h1dor-0006Pz-0C for qemu-devel@nongnu.org; Wed, 06 Mar 2019 16:11:17 -0500 Received: from mx1.redhat.com ([209.132.183.28]:36360) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1h1doq-0006Pc-PY for qemu-devel@nongnu.org; Wed, 06 Mar 2019 16:11:16 -0500 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 67F6D369CD; Wed, 6 Mar 2019 21:04:36 +0000 (UTC) Received: from gigantic.usersys.redhat.com (helium.bos.redhat.com [10.18.17.132]) by smtp.corp.redhat.com (Postfix) with ESMTP id 66D0B5C1A1; Wed, 6 Mar 2019 21:04:34 +0000 (UTC) From: Bandan Das To: qemu-devel@nongnu.org Date: Wed, 6 Mar 2019 16:04:07 -0500 Message-Id: <20190306210409.14842-2-bsd@redhat.com> In-Reply-To: <20190306210409.14842-1-bsd@redhat.com> References: <20190306210409.14842-1-bsd@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Wed, 06 Mar 2019 21:04:36 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v2 1/3] usb-mtp: return incomplete transfer on a lstat failure X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org, kraxel@redhat.com Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP MTP writes objects in small chunks and at the end gets the real file size to update the object metadata. If this fails for any reason, return an INCOMPLETE_TRANSFER to the initiator Spotted by Coverity: CID 1398651 Signed-off-by: Bandan Das --- hw/usb/dev-mtp.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 4ee4fc5a89..4dde14fc78 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1591,14 +1591,18 @@ done: return ret; } -static void usb_mtp_update_object(MTPObject *parent, char *name) +static int usb_mtp_update_object(MTPObject *parent, char *name) { + int ret = -1; + MTPObject *o = usb_mtp_object_lookup_name(parent, name, strlen(name)); if (o) { - lstat(o->path, &o->stat); + ret = lstat(o->path, &o->stat); } + + return ret; } static void usb_mtp_write_data(MTPState *s) @@ -1655,13 +1659,18 @@ static void usb_mtp_write_data(MTPState *s) if (d->write_status != WRITE_END) { return; } else { - /* Only for < 4G file sizes */ - if (s->dataset.size != 0xFFFFFFFF && d->offset != s->dataset.size) { + /* + * Return an incomplete transfer if file size doesn't match + * for < 4G file or if lstat fails which will result in an incorrect + * file size + */ + if ((s->dataset.size != 0xFFFFFFFF && + d->offset != s->dataset.size) || + usb_mtp_update_object(parent, s->dataset.filename)) { usb_mtp_queue_result(s, RES_INCOMPLETE_TRANSFER, d->trans, 0, 0, 0, 0); goto done; } - usb_mtp_update_object(parent, s->dataset.filename); } } From patchwork Wed Mar 6 21:04:08 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bandan Das X-Patchwork-Id: 10841783 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id E9A66180E for ; Wed, 6 Mar 2019 21:14:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D5EE82E167 for ; Wed, 6 Mar 2019 21:14:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CA3632E195; Wed, 6 Mar 2019 21:14:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 65FDF2E183 for ; Wed, 6 Mar 2019 21:14:43 +0000 (UTC) Received: from localhost ([127.0.0.1]:39646 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h1dsA-0007Tz-OU for patchwork-qemu-devel@patchwork.kernel.org; Wed, 06 Mar 2019 16:14:42 -0500 Received: from eggs.gnu.org ([209.51.188.92]:53111) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h1drI-0006nX-Me for qemu-devel@nongnu.org; Wed, 06 Mar 2019 16:13:49 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1h1drH-0007U0-Uj for qemu-devel@nongnu.org; Wed, 06 Mar 2019 16:13:48 -0500 Received: from mx1.redhat.com ([209.132.183.28]:49772) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1h1drG-0007SJ-Tg for qemu-devel@nongnu.org; Wed, 06 Mar 2019 16:13:47 -0500 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 06D6C307EAB3; Wed, 6 Mar 2019 21:04:37 +0000 (UTC) Received: from gigantic.usersys.redhat.com (helium.bos.redhat.com [10.18.17.132]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8984C5C1A1; Wed, 6 Mar 2019 21:04:36 +0000 (UTC) From: Bandan Das To: qemu-devel@nongnu.org Date: Wed, 6 Mar 2019 16:04:08 -0500 Message-Id: <20190306210409.14842-3-bsd@redhat.com> In-Reply-To: <20190306210409.14842-1-bsd@redhat.com> References: <20190306210409.14842-1-bsd@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.44]); Wed, 06 Mar 2019 21:04:37 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v2 2/3] usb-mtp: fix some usb_mtp_write_data return paths X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org, kraxel@redhat.com Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP During a write, free up the "path" before getting more data. Also, while we at it, remove the confusing usage of d->fd for storing mkdir status Spotted by Coverity: CID 1398642 Signed-off-by: Bandan Das --- hw/usb/dev-mtp.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 4dde14fc78..1f22284949 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1605,7 +1605,7 @@ static int usb_mtp_update_object(MTPObject *parent, char *name) return ret; } -static void usb_mtp_write_data(MTPState *s) +static int usb_mtp_write_data(MTPState *s) { MTPData *d = s->data_out; MTPObject *parent = @@ -1613,6 +1613,7 @@ static void usb_mtp_write_data(MTPState *s) char *path = NULL; uint64_t rc; mode_t mask = 0644; + int ret = 0; assert(d != NULL); @@ -1621,13 +1622,13 @@ static void usb_mtp_write_data(MTPState *s) if (!parent || !s->write_pending) { usb_mtp_queue_result(s, RES_INVALID_OBJECTINFO, d->trans, 0, 0, 0, 0); - return; + return 1; } if (s->dataset.filename) { path = g_strdup_printf("%s/%s", parent->path, s->dataset.filename); if (s->dataset.format == FMT_ASSOCIATION) { - d->fd = mkdir(path, mask); + ret = mkdir(path, mask); goto free; } d->fd = open(path, O_CREAT | O_WRONLY | @@ -1657,7 +1658,8 @@ static void usb_mtp_write_data(MTPState *s) goto done; } if (d->write_status != WRITE_END) { - return; + g_free(path); + return ret; } else { /* * Return an incomplete transfer if file size doesn't match @@ -1685,12 +1687,14 @@ done: */ if (d->fd != -1) { close(d->fd); + d->fd = -1; } free: g_free(s->dataset.filename); s->dataset.size = 0; g_free(path); s->write_pending = false; + return ret; } static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) @@ -1727,14 +1731,12 @@ static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) s->write_pending = true; if (s->dataset.format == FMT_ASSOCIATION) { - usb_mtp_write_data(s); - /* next_handle will be allocated to the newly created dir */ - if (d->fd == -1) { + if (usb_mtp_write_data(s)) { + /* next_handle will be allocated to the newly created dir */ usb_mtp_queue_result(s, RES_STORE_FULL, d->trans, 0, 0, 0, 0); return; } - d->fd = -1; } usb_mtp_queue_result(s, RES_OK, d->trans, 3, QEMU_STORAGE_ID, From patchwork Wed Mar 6 21:04:09 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bandan Das X-Patchwork-Id: 10841785 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BB82417E4 for ; Wed, 6 Mar 2019 21:14:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AA67B2E167 for ; Wed, 6 Mar 2019 21:14:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9F3D12E183; Wed, 6 Mar 2019 21:14:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 13E382E171 for ; Wed, 6 Mar 2019 21:14:40 +0000 (UTC) Received: from localhost ([127.0.0.1]:39644 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h1ds8-0007Sg-4O for patchwork-qemu-devel@patchwork.kernel.org; Wed, 06 Mar 2019 16:14:40 -0500 Received: from eggs.gnu.org ([209.51.188.92]:53101) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h1drH-0006nS-UH for qemu-devel@nongnu.org; Wed, 06 Mar 2019 16:13:48 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1h1drG-0007TN-Vw for qemu-devel@nongnu.org; Wed, 06 Mar 2019 16:13:47 -0500 Received: from mx1.redhat.com ([209.132.183.28]:64810) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1h1drG-0007SK-6M for qemu-devel@nongnu.org; Wed, 06 Mar 2019 16:13:46 -0500 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 914BC3089EC4; Wed, 6 Mar 2019 21:04:37 +0000 (UTC) Received: from gigantic.usersys.redhat.com (helium.bos.redhat.com [10.18.17.132]) by smtp.corp.redhat.com (Postfix) with ESMTP id 23C645C1A1; Wed, 6 Mar 2019 21:04:37 +0000 (UTC) From: Bandan Das To: qemu-devel@nongnu.org Date: Wed, 6 Mar 2019 16:04:09 -0500 Message-Id: <20190306210409.14842-4-bsd@redhat.com> In-Reply-To: <20190306210409.14842-1-bsd@redhat.com> References: <20190306210409.14842-1-bsd@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.44]); Wed, 06 Mar 2019 21:04:37 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v2 3/3] usb-mtp: prevent null dereference while deleting objects X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org, kraxel@redhat.com Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP Spotted by Coverity: CID 1399144 Signed-off-by: Bandan Das --- hw/usb/dev-mtp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 1f22284949..06e376bcd2 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1177,9 +1177,7 @@ static int usb_mtp_deletefn(MTPState *s, MTPObject *o, uint32_t trans) usb_mtp_object_free_one(s, o); success = true; } - } - - if (o->format == FMT_ASSOCIATION) { + } else if (o->format == FMT_ASSOCIATION) { if (rmdir(o->path)) { partial_delete = true; } else {