On Fri, Feb 09, 2024 at 10:33:20AM +0000, Greg KH wrote:
> On Thu, Feb 08, 2024 at 02:32:09PM -0500, Stefan Hajnoczi wrote:
> > Newlines in virtiofs tags are awkward for users and potential vectors
> > for string injection attacks.
> >
> > Signed-off-by: Stefan Hajnoczi <stefanha@xxxxxxxxxx>
> > ---
> > fs/fuse/virtio_fs.c | 10 ++++++++++
> > 1 file changed, 10 insertions(+)
> >
> > diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
> > index 5f1be1da92ce..de9a38efdf1e 100644
> > --- a/fs/fuse/virtio_fs.c
> > +++ b/fs/fuse/virtio_fs.c
> > @@ -323,6 +323,16 @@ static int virtio_fs_read_tag(struct virtio_device *vdev, struct virtio_fs *fs)
> > return -ENOMEM;
> > memcpy(fs->tag, tag_buf, len);
> > fs->tag[len] = '\0';
> > +
> > + /* While the VIRTIO specification allows any character, newlines are
> > + * awkward on mount(8) command-lines and cause problems in the sysfs
> > + * "tag" attr and uevent TAG= properties. Forbid them.
> > + */
> > + if (strchr(fs->tag, '\n')) {
> > + dev_err(&vdev->dev, "refusing virtiofs tag with newline character\n");
>
> Please don't let userspace spam mthe kernel log if they are the ones
> that are setting the tags. Just make this a debug message instead.
This check is performed while probing the device. Userspace is not
involved but I'll change it to dev_dbg() anyway.
Stefan
Attachment:
signature.asc
Description: PGP signature
