lib/tinykvm/linux/system_calls.cpp:3057 (SYS_statx).
The is_readable_path() check sets regs.sysret() = -EPERM inside a bare if
with no else and no early return, so the fd translation and the host
statx() call below it run unconditionally and overwrite sysret(). The
sibling newfstatat handler at :2528 gates the same check correctly, so the
two handlers disagree on the same denied path.
Fix: move the fd translation and the host call into the else of the
is_readable_path check, preserving the existing path.empty() /
AT_EMPTY_PATH case.
Found by an internal audit of the host-side Linux emulation. A fix PR with a
regression test follows.
lib/tinykvm/linux/system_calls.cpp:3057(SYS_statx).The
is_readable_path()check setsregs.sysret() = -EPERMinside a bareifwith no
elseand no early return, so the fd translation and the hoststatx()call below it run unconditionally and overwritesysret(). Thesibling
newfstatathandler at :2528 gates the same check correctly, so thetwo handlers disagree on the same denied path.
Fix: move the fd translation and the host call into the
elseof theis_readable_pathcheck, preserving the existingpath.empty()/AT_EMPTY_PATHcase.Found by an internal audit of the host-side Linux emulation. A fix PR with a
regression test follows.