From: Vivek Goyal Date: Mon, 8 Feb 2021 17:40:23 -0500 Subject: virtiofsd: Save error code early at the failure callsite Git-commit: 1e08f164e9fdc9528ad6990012301b9a04b0bc90 References: bsc#1183373, CVE-2021-20263 Change error code handling slightly in lo_setattr(). Right now we seem to jump to out_err and assume that "errno" is valid and use that to send reply. But if caller has to do some other operations before jumping to out_err, then it does the dance of first saving errno to saverr and the restore errno before jumping to out_err. This makes it more confusing. I am about to make more changes where caller will have to do some work after error before jumping to out_err. I found it easier to change the convention a bit. That is caller saves error in "saverr" before jumping to out_err. And out_err uses "saverr" to send error back and does not rely on "errno" having actual error. v3: Resolved conflicts in lo_setattr() due to lo_inode_open() changes. Signed-off-by: Vivek Goyal Reviewed-by: Dr. David Alan Gilbert Message-Id: <20210208224024.43555-2-vgoyal@redhat.com> Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Bruce Rogers --- tools/virtiofsd/passthrough_ll.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c index 90f5281f10ab747098e57a3157c1..200a1d26bd11bcde5729c4f33195 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -710,6 +710,7 @@ static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr, res = fchmodat(lo->proc_self_fd, procname, attr->st_mode, 0); } if (res == -1) { + saverr = errno; goto out_err; } } @@ -719,6 +720,7 @@ static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr, res = fchownat(ifd, "", uid, gid, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW); if (res == -1) { + saverr = errno; goto out_err; } } @@ -730,16 +732,15 @@ static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr, } else { truncfd = lo_inode_open(lo, inode, O_RDWR); if (truncfd < 0) { - errno = -truncfd; + saverr = -truncfd; goto out_err; } } res = ftruncate(truncfd, attr->st_size); + saverr = res == -1 ? errno : 0; if (!fi) { - saverr = errno; close(truncfd); - errno = saverr; } if (res == -1) { goto out_err; @@ -772,6 +773,7 @@ static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr, res = utimensat(lo->proc_self_fd, procname, tv, 0); } if (res == -1) { + saverr = errno; goto out_err; } } @@ -780,7 +782,6 @@ static void lo_setattr(fuse_req_t req, fuse_ino_t ino, struct stat *attr, return lo_getattr(req, ino, fi); out_err: - saverr = errno; lo_inode_put(lo, &inode); fuse_reply_err(req, saverr); }