From 2e29cfc81d11d4778aa3038ba3ed254c3dccdc7f Mon Sep 17 00:00:00 2001 From: Ayush Ranjan Date: Wed, 19 Jan 2022 16:12:55 -0800 Subject: [PATCH] Do not allow to walk on deleted nodes for security. As described in the change, walking on a deleted file can be dangerous. A malicious client could have replaced it with a hazardous symlink. And depending on the file implementation, this could be dangerous. Some file implementations might be using host paths for each operation and performing host walks. PiperOrigin-RevId: 422928261 --- pkg/p9/handlers.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkg/p9/handlers.go b/pkg/p9/handlers.go index 9aa853398..842b00855 100644 --- a/pkg/p9/handlers.go +++ b/pkg/p9/handlers.go @@ -1280,6 +1280,13 @@ func doWalk(cs *connState, ref *fidRef, names []string, getattr bool) (qids []QI var sf File // Temporary. if err := walkRef.safelyRead(func() (err error) { + // It is not safe to walk on a deleted directory. It could have been + // replaced with a malicious symlink. + if walkRef.isDeleted() { + // Fail this operation as the result will not be meaningful if walkRef + // is deleted. + return unix.ENOENT + } // Pass getattr = true to walkOne since we need the file type for // newRef. qids, sf, valid, attr, err = walkOne(qids, walkRef.file, names[i:i+1], true)