virtiofs: forbid newlines in tags

[ Upstream commit 40488cc16f7ea0d193a4e248f0d809c25cc377db ]

Newlines in virtiofs tags are awkward for users and potential vectors
for string injection attacks.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
index 7d4655022afc6d5b8c321c7e06d8af01da43b2fc..c50999ad9f7abaadc121fc8344fc9ae8c4fa8a45 100644 (file)
--- a/fs/fuse/virtio_fs.c
+++ b/fs/fuse/virtio_fs.c
@@ -315,6 +315,16 @@ static int virtio_fs_read_tag(struct virtio_device *vdev, struct virtio_fs *fs)
                return -ENOMEM;
        memcpy(fs->tag, tag_buf, len);
        fs->tag[len] = '\0';
+
+       /* While the VIRTIO specification allows any character, newlines are
+        * awkward on mount(8) command-lines and cause problems in the sysfs
+        * "tag" attr and uevent TAG= properties. Forbid them.
+        */
+       if (strchr(fs->tag, '\n')) {
+               dev_dbg(&vdev->dev, "refusing virtiofs tag with newline character\n");
+               return -EINVAL;
+       }
+
        return 0;
 }