Skip to content

compat/linux: return EBADF for O_PATH mmap() and xattr operations #2181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ilovegrape wants to merge 1 commit into
base: main
Choose a base branch
from
+51 −0
Open

compat/linux: return EBADF for O_PATH mmap() and xattr operations #2181

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions sys/compat/linux/linux_mmap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,10 @@ static int
linux_mmap_check_fp(struct file *fp, int flags, int prot, int maxprot)
{

/* Linux returns EBADF if mmap() is called on an O_PATH file descriptor */
if (fp->f_ops == &path_fileops)
return (EBADF);
Comment thread
ilovegrape marked this conversation as resolved.

/* Linux mmap() just fails for O_WRONLY files */
if ((fp->f_flag & FREAD) == 0)
return (EACCES);
Expand Down
47 changes: 47 additions & 0 deletions sys/compat/linux/linux_xattr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,10 @@
*/

#include <sys/param.h>
#include <sys/capsicum.h>
#include <sys/extattr.h>
#include <sys/fcntl.h>
#include <sys/file.h>
#include <sys/namei.h>
#include <sys/proc.h>
#include <sys/syscallsubr.h>
Expand Down Expand Up @@ -84,6 +86,19 @@ struct removexattr_args {
int follow;
};

static int
linux_xattr_check_fd(struct thread *td, int fd, cap_rights_t *rights)
{
struct file *fp;
int error;

error = getvnode(td, fd, rights, &fp);
if (error != 0)
return (error);
fdrop(fp, td);
Copy link
Copy Markdown
Member

@kostikbel kostikbel May 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a TOTTOU race.

Copy link
Copy Markdown
Author

@ilovegrape ilovegrape May 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point, I need to think a little deeply into it...

return (0);
}

static char *extattr_namespace_names[] = EXTATTR_NAMESPACE_NAMES;


Expand Down Expand Up @@ -132,12 +147,20 @@ listxattr(struct thread *td, struct listxattr_args *args)
{
char attrname[LINUX_XATTR_NAME_MAX + 1];
char *data, *prefix, *key;
cap_rights_t rights;
struct uio auio;
struct iovec aiov;
unsigned char keylen;
size_t sz, cnt, rs, prefixlen, pairlen;
int attrnamespace, error;

if (args->path == NULL) {
error = linux_xattr_check_fd(td, args->fd,
cap_rights_init_one(&rights, CAP_EXTATTR_LIST));
if (error != 0)
return (error);
}

if (args->size != 0)
sz = min(LINUX_XATTR_LIST_MAX, args->size);
else
Expand Down Expand Up @@ -253,8 +276,16 @@ static int
removexattr(struct thread *td, struct removexattr_args *args)
{
char attrname[LINUX_XATTR_NAME_MAX + 1];
cap_rights_t rights;
int attrnamespace, error;

if (args->path == NULL) {
error = linux_xattr_check_fd(td, args->fd,
cap_rights_init_one(&rights, CAP_EXTATTR_DELETE));
if (error != 0)
return (error);
}

error = xattr_to_extattr(args->name, &attrnamespace, attrname);
if (error != 0)
return (error);
Expand Down Expand Up @@ -310,8 +341,16 @@ static int
getxattr(struct thread *td, struct getxattr_args *args)
{
char attrname[LINUX_XATTR_NAME_MAX + 1];
cap_rights_t rights;
int attrnamespace, error;

if (args->path == NULL) {
error = linux_xattr_check_fd(td, args->fd,
cap_rights_init_one(&rights, CAP_EXTATTR_GET));
if (error != 0)
return (error);
}

error = xattr_to_extattr(args->name, &attrnamespace, attrname);
if (error != 0)
return (error);
Expand Down Expand Up @@ -373,8 +412,16 @@ static int
setxattr(struct thread *td, struct setxattr_args *args)
{
char attrname[LINUX_XATTR_NAME_MAX + 1];
cap_rights_t rights;
int attrnamespace, error;

if (args->path == NULL) {
error = linux_xattr_check_fd(td, args->fd,
cap_rights_init_one(&rights, CAP_EXTATTR_SET));
if (error != 0)
return (error);
}

if ((args->flags & ~(LINUX_XATTR_FLAGS)) != 0 ||
args->flags == (LINUX_XATTR_FLAGS))
return (EINVAL);
Expand Down
Loading