9ns: ensure the parent of a rename target is a directory
authorBarret Rhoden <brho@cs.berkeley.edu>
Tue, 30 Apr 2019 00:21:08 +0000 (20:21 -0400)
committerBarret Rhoden <brho@cs.berkeley.edu>
Tue, 30 Apr 2019 00:21:08 +0000 (20:21 -0400)
We subtracted the last element from the walk, but never checked that the
result of the walk was a directory.

Reported-by: syzbot+7e385d5c8a674a08d28a@syzkaller.appspotmail.com
Signed-off-by: Barret Rhoden <brho@cs.berkeley.edu>
kern/src/ns/chan.c

index 26d812b..0012d72 100644 (file)
@@ -1301,6 +1301,8 @@ Open:
                 * the way out, we putmhead if we have an m, and clean up our
                 * chans.  On success, c becomes cnew (thus close the old c).
                 * On failure, we just close cnew. */
+               if (!(c->qid.type & QTDIR))
+                       error(ENOTDIR, "rename target parent is not a dir");
                e.ARRAY_SIZEs++;
                m = NULL;
                cnew = NULL;