tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

tools/hv: fcopy: Fix incorrect file path conversion

The hv_fcopy_uio_daemon fails to correctly handle file copy requests
from Windows hosts (e.g. via Copy-VMFile) due to wchar_t size
differences between Windows and Linux. On Linux, wchar_t is 32 bit,
whereas Windows uses 16 bit wide characters.

Fix this by ensuring that file transfers from host to Linux guest
succeed with correctly decoded file names and paths.

- Treats file name and path as __u16 arrays, not wchar_t*.
- Allocates fixed-size buffers (W_MAX_PATH) for converted strings
instead of using malloc.
- Adds a check for target path length to prevent snprintf() buffer
overflow.

Fixes: 82b0945ce2c2 ("tools: hv: Add new fcopy application based on uio driver")
Signed-off-by: Yasumasa Suenaga <yasuenag@gmail.com>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250628022217.1514-2-yasuenag@gmail.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Message-ID: <20250628022217.1514-2-yasuenag@gmail.com>

authored by

Yasumasa Suenaga and committed by
Wei Liu 0d86a8d6 7b89a44b

+14 -23
+14 -23
tools/hv/hv_fcopy_uio_daemon.c
··· 62 62 63 63 filesize = 0; 64 64 p = path_name; 65 - snprintf(target_fname, sizeof(target_fname), "%s/%s", 66 - path_name, file_name); 65 + if (snprintf(target_fname, sizeof(target_fname), "%s/%s", 66 + path_name, file_name) >= sizeof(target_fname)) { 67 + syslog(LOG_ERR, "target file name is too long: %s/%s", path_name, file_name); 68 + goto done; 69 + } 67 70 68 71 /* 69 72 * Check to see if the path is already in place; if not, ··· 273 270 { 274 271 size_t len = 0; 275 272 276 - while (len < dest_size) { 273 + while (len < dest_size && *src) { 277 274 if (src[len] < 0x80) 278 275 dest[len++] = (char)(*src++); 279 276 else ··· 285 282 286 283 static int hv_fcopy_start(struct hv_start_fcopy *smsg_in) 287 284 { 285 + /* 286 + * file_name and path_name should have same length with appropriate 287 + * member of hv_start_fcopy. 288 + */ 289 + char file_name[W_MAX_PATH], path_name[W_MAX_PATH]; 290 + 288 291 setlocale(LC_ALL, "en_US.utf8"); 289 - size_t file_size, path_size; 290 - char *file_name, *path_name; 291 - char *in_file_name = (char *)smsg_in->file_name; 292 - char *in_path_name = (char *)smsg_in->path_name; 293 - 294 - file_size = wcstombs(NULL, (const wchar_t *restrict)in_file_name, 0) + 1; 295 - path_size = wcstombs(NULL, (const wchar_t *restrict)in_path_name, 0) + 1; 296 - 297 - file_name = (char *)malloc(file_size * sizeof(char)); 298 - path_name = (char *)malloc(path_size * sizeof(char)); 299 - 300 - if (!file_name || !path_name) { 301 - free(file_name); 302 - free(path_name); 303 - syslog(LOG_ERR, "Can't allocate memory for file name and/or path name"); 304 - return HV_E_FAIL; 305 - } 306 - 307 - wcstoutf8(file_name, (__u16 *)in_file_name, file_size); 308 - wcstoutf8(path_name, (__u16 *)in_path_name, path_size); 292 + wcstoutf8(file_name, smsg_in->file_name, W_MAX_PATH - 1); 293 + wcstoutf8(path_name, smsg_in->path_name, W_MAX_PATH - 1); 309 294 310 295 return hv_fcopy_create_file(file_name, path_name, smsg_in->copy_flags); 311 296 }