Re: [PATCH] tools/kvm_stat: fix attack vector with user controlled FUSE mounts

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Nov 03, 2022 at 03:21:12PM +0100, Paolo Bonzini wrote:
> On 11/3/22 14:59, Matthias Gerstner wrote:
> > The fix is simply to use the file system type field instead. Whitespace
> > in the mount path is escaped in /proc/mounts thus no further safety
> > measures in the parsing should be necessary to make this correct.
> 
> Can you please send a patch to replace seq_printf with seq_escape in 
> afs_show_devname though?  I couldn't find anything that prevents 
> cell->name and volume->name from containing a space, so better safe than 
> sorry.

I only checked this during runtime using a tmpfs and assumed this would
be true for all file systems.

Sure I can come up with a patch. Should I send a new single patch
containing both changes, a new patch series with two patches or do I
need to send the afs change to a different mailing list? Sorry - I'm new
to kernel development.

Cheers

Matthias

Attachment: signature.asc
Description: PGP signature


[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux