On 7/24/20 3:25 PM, Daniel P. Berrangé wrote: > This introduces two new helper metohds > > int qemu_open(const char *name, int flags, Error **errp); > int qemu_create(const char *name, int flags, mode_t mode, Error **errp); > > Note that with this design we no longer require or even accept the > O_CREAT flag. Avoiding overloading the two distinct operations > means we can avoid variable arguments which would prevent 'errp' from > being the last argument. It also gives us a guarantee that the 'mode' is > given when creating files, avoiding a latent security bug. > > Signed-off-by: Daniel P. Berrangé <berra...@redhat.com> > --- > include/qemu/osdep.h | 6 ++++ > util/osdep.c | 78 ++++++++++++++++++++++++++++++++++++-------- > 2 files changed, 71 insertions(+), 13 deletions(-) > > diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h > index 3a16e58932..ca24ebe211 100644 > --- a/include/qemu/osdep.h > +++ b/include/qemu/osdep.h > @@ -494,7 +494,13 @@ int qemu_madvise(void *addr, size_t len, int advice); > int qemu_mprotect_rwx(void *addr, size_t size); > int qemu_mprotect_none(void *addr, size_t size); > > +/* > + * Don't introduce new usage of this function, prefer the following > + * qemu_open/qemu_create that take a "Error **errp" > + */ > int qemu_open_old(const char *name, int flags, ...); > +int qemu_open(const char *name, int flags, Error **errp); > +int qemu_create(const char *name, int flags, mode_t mode, Error **errp); > int qemu_close(int fd); > int qemu_unlink(const char *name); > #ifndef _WIN32 > diff --git a/util/osdep.c b/util/osdep.c > index 9df1b6adec..5c0f4684b1 100644 > --- a/util/osdep.c > +++ b/util/osdep.c > @@ -22,6 +22,7 @@ > * THE SOFTWARE. > */ > #include "qemu/osdep.h" > +#include "qapi/error.h" > > /* Needed early for CONFIG_BSD etc. */ > > @@ -282,10 +283,10 @@ int qemu_lock_fd_test(int fd, int64_t start, int64_t > len, bool exclusive) > /* > * Opens a file with FD_CLOEXEC set > */ > -int qemu_open_old(const char *name, int flags, ...) > +static int > +qemu_open_internal(const char *name, int flags, mode_t mode, Error **errp) > { > int ret; > - int mode = 0; > > #ifndef _WIN32 > const char *fdset_id_str; > @@ -297,24 +298,31 @@ int qemu_open_old(const char *name, int flags, ...) > > fdset_id = qemu_parse_fdset(fdset_id_str); > if (fdset_id == -1) { > + error_setg(errp, "Could not parse fdset %s", name); > errno = EINVAL; > return -1; > } > > fd = monitor_fdset_get_fd(fdset_id, flags); > if (fd < 0) { > + error_setg_errno(errp, -fd, "Could not acquire FD for %s flags > %x", > + name, flags); > errno = -fd; > return -1; > } > > dupfd = qemu_dup_flags(fd, flags); > if (dupfd == -1) { > + error_setg_errno(errp, errno, "Could not dup FD for %s flags %x", > + name, flags); > return -1; > } > > ret = monitor_fdset_dup_fd_add(fdset_id, dupfd); > if (ret == -1) { > close(dupfd); > + error_setg(errp, "Could not save FD for %s flags %x", > + name, flags); > errno = EINVAL; > return -1; > } > @@ -323,22 +331,66 @@ int qemu_open_old(const char *name, int flags, ...) > } > #endif > > - if (flags & O_CREAT) { > - va_list ap; > - > - va_start(ap, flags); > - mode = va_arg(ap, int); > - va_end(ap); > - } > - > #ifdef O_CLOEXEC > - ret = open(name, flags | O_CLOEXEC, mode); > -#else > + flags |= O_CLOEXEC; > +#endif /* O_CLOEXEC */ > + > ret = open(name, flags, mode); > + > +#ifndef O_CLOEXEC > if (ret >= 0) { > qemu_set_cloexec(ret); > } > -#endif > +#endif /* ! O_CLOEXEC */ > + > + if (ret == -1) { > + const char *action = "open"; > + if (flags & O_CREAT) { > + action = "create"; > + } > + error_setg_errno(errp, errno, "Could not %s '%s' flags 0x%x", > + action, name, flags); > + } > +
NL-- > + > + return ret; > +} > + > + > +int qemu_open(const char *name, int flags, Error **errp) > +{ > + if (flags & O_CREAT) { > + error_setg(errp, > + "Invalid O_CREAT flag passed to qemu_open, use > qemu_create"); > + return -1; > + } > + return qemu_open_internal(name, flags, 0, errp); > +} > + > + > +int qemu_create(const char *name, int flags, mode_t mode, Error **errp) > +{ > + if (flags & O_CREAT) { > + error_setg(errp, "Redundant O_CREAT flag passed to qemu_create"); > + return -1; > + } > + return qemu_open_internal(name, flags | O_CREAT, mode, errp); > +} > + > + I'd rather see this patch split as: - extract qemu_open_internal(const char *name, int flags, mode_t mode) from qemu_open_old() - Add Error **errp to qemu_open_internal() - add qemu_open() and qemu_create() Preferably split: Reviewed-by: Philippe Mathieu-Daudé <phi...@redhat.com> > +int qemu_open_old(const char *name, int flags, ...) > +{ > + va_list ap; > + mode_t mode = 0; > + int ret; > + > + va_start(ap, flags); > + if (flags & O_CREAT) { > + mode = va_arg(ap, int); > + } > + va_end(ap); > + > + ret = qemu_open_internal(name, flags, mode, NULL); > > #ifdef O_DIRECT > if (ret == -1 && errno == EINVAL && (flags & O_DIRECT)) { >