Re: [PATCH v4 3/3] virtiofsd: prevent opening of special files (CVE-2020-35517)

[Vivek Goyal]

On Wed, Feb 03, 2021 at 11:37:19AM +0000, Stefan Hajnoczi wrote:

[..]
> @@ -1727,36 +1764,38 @@ static void lo_create(fuse_req_t req, fuse_ino_t 
> parent, const char *name,
>  
>      update_open_flags(lo->writeback, lo->allow_direct_io, fi);
>  
> -    fd = openat(parent_inode->fd, name, (fi->flags | O_CREAT) & ~O_NOFOLLOW,
> -                mode);
> +    /* Try to create a new file but don't open existing files */
> +    fd = openat(parent_inode->fd, name, fi->flags | O_CREAT | O_EXCL, mode);
>      err = fd == -1 ? errno : 0;
> +
>      lo_restore_cred(&old);
>  
> -    if (!err) {
> -        ssize_t fh;
> -
> -        pthread_mutex_lock(&lo->mutex);
> -        fh = lo_add_fd_mapping(lo, fd);
> -        pthread_mutex_unlock(&lo->mutex);
> -        if (fh == -1) {
> -            close(fd);
> -            err = ENOMEM;
> -            goto out;
> -        }
> +    /* Ignore the error if file exists and O_EXCL was not given */
> +    if (err && !(err == EEXIST && !(fi->flags & O_EXCL))) {

Can this check be simplified to.
       if (err && (err == EEXIST && (fi->flags & O_EXCL)) {
           goto out;
       }
> +        goto out;
> +    }


Vivek