From 33f7ddb5ed4f41b79a62108581b7f0debbddc865 Mon Sep 17 00:00:00 2001 From: Oliver Hartkopp Date: Wed, 14 Oct 2026 09:54:42 +0000 Subject: [PATCH] isobusfs: srv: check handle state and owner for read and seek requests Read File and Seek File requests only checked the handle index to be within the handles array. Unused or closed handle slots are zeroed (fd = 0, dir = NULL), so a read request on such a handle read from the server's stdin and sent the content to the client. Additionally every client was able to read and seek handles opened by other clients. Add isobusfs_srv_get_client_handle() which only returns handles that are in use and have been opened by the requesting client. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Oliver Hartkopp --- isobusfs/isobusfs_srv_fa.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/isobusfs/isobusfs_srv_fa.c b/isobusfs/isobusfs_srv_fa.c index 039f324..a106d38 100644 --- a/isobusfs/isobusfs_srv_fa.c +++ b/isobusfs/isobusfs_srv_fa.c @@ -108,6 +108,28 @@ isobusfs_srv_get_handle(struct isobusfs_srv_priv *priv, int handle) return &priv->handles[handle]; } +/* + * Return the handle only when it is in use and has been opened by the + * requesting client. Otherwise return NULL. + */ +static struct isobusfs_srv_handles * +isobusfs_srv_get_client_handle(struct isobusfs_srv_priv *priv, + struct isobusfs_srv_client *client, int handle) +{ + struct isobusfs_srv_handles *hdl = isobusfs_srv_get_handle(priv, handle); + unsigned int i; + + if (!hdl || !hdl->path) + return NULL; + + for (i = 0; i < ARRAY_SIZE(hdl->clients); i++) { + if (hdl->clients[i] == client) + return hdl; + } + + return NULL; +} + static int isobusfs_srv_release_handle(struct isobusfs_srv_priv *priv, struct isobusfs_srv_client *client, int handle) @@ -743,7 +765,7 @@ static int isobusfs_srv_fa_rf_req(struct isobusfs_srv_priv *priv, goto send_response; } - handle = isobusfs_srv_get_handle(priv, req->handle); + handle = isobusfs_srv_get_client_handle(priv, client, req->handle); if (!handle) { pr_warn("failed to find file with handle: %x", req->handle); error_code = ISOBUSFS_ERR_FILE_ORPATH_NOT_FOUND; @@ -959,7 +981,7 @@ static int isobusfs_srv_fa_sf_req(struct isobusfs_srv_priv *priv, goto send_response; } - handle = isobusfs_srv_get_handle(priv, req->handle); + handle = isobusfs_srv_get_client_handle(priv, client, req->handle); if (!handle) { pr_warn("failed to find handle: %x", req->handle); error_code = ISOBUSFS_ERR_INVALID_HANDLE;