Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp306149imu; Mon, 5 Nov 2018 00:54:50 -0800 (PST) X-Google-Smtp-Source: AJdET5fprGK1lHDFy8EusiR1wRRalqM1/MVEZrl0kYcAY6A37VgxRn1AoTGjdyIkYPfeD2fwCtdu X-Received: by 2002:a17:902:9004:: with SMTP id a4-v6mr21124508plp.334.1541408090560; Mon, 05 Nov 2018 00:54:50 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1541408090; cv=none; d=google.com; s=arc-20160816; b=ONCivnyTwOQTTN80ro9ovw3W7yi9hCFbdQSZqlRlm2JCNSJxMXw2LR8hQZP3tm5azN juPKNo0yBfW/AyzC0wODHD46ZxXTiemcnYQnnERVbc2SF/St7a+96crFhEhLNa3G5hoJ hsrkvgJ7DyoTErfO1y5TcRKLj4rpx8eZlL3HPpUc52ccakOvc4yBmqZvwIAf3k080rwb LQ/25L1b59/E1I7aKm+vcFan+0n3dRAFB7u5auIlNuRVeg8zQAzIv4hetBAzdY3bbJCa 4oD0yrUa9uC+OhkSnGcfKDz7Mx2S3N/VmsBdf4MOaLzcw0FF7L5AZYwgDySEEeMk43sE wgAw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:to:references:in-reply-to:message-id:date :subject:cc:from; bh=ucD6wvAZ9S1ih3jfqdeh+y/p4n62IEH+1mkowp8j1zU=; b=GvUWS8PFV3k4oOqQeRI99FUGUWRxJ0THr1P8jNdV3XXzTB3CM6W1Dq3bfPukXx5cU8 OvuJ/qyHyV2IbPPu2WlZvSbDEQHzwMtS2pfj371REoSFSVnelzA7B65SzIisKQhvJl8+ Q8InethCHQIroBH7t4aUVUl41yhEi+Iw2XvVQJC9lkFVcdoQt+dY2Fbxce2u796gg5Il aCoWAzD5EsxficY2UgnCN1uXiCgbQuQkWCzIHu2q4ys+UzxvS3NZGmRtBhw81y6J/UVb uRumdzW+LoMPFvva0nlw1Sm9TOyWcx1d5tsRGNr97nB+2sVBnIH9n8uhho5Ctlef7MmL AfZA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f1-v6si37662035plf.156.2018.11.05.00.54.35; Mon, 05 Nov 2018 00:54:50 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728667AbeKESLh (ORCPT + 99 others); Mon, 5 Nov 2018 13:11:37 -0500 Received: from nautica.notk.org ([91.121.71.147]:34367 "EHLO nautica.notk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726125AbeKESLh (ORCPT ); Mon, 5 Nov 2018 13:11:37 -0500 Received: by nautica.notk.org (Postfix, from userid 1001) id EEB72C009; Mon, 5 Nov 2018 09:52:55 +0100 (CET) From: Dominique Martinet Cc: Dominique Martinet , Eric Van Hensbergen , Latchesar Ionkov , syzkaller-bugs@googlegroups.com, v9fs-developer@lists.sourceforge.net, linux-kernel@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH] 9p/net: put a lower bound on msize Date: Mon, 5 Nov 2018 09:52:48 +0100 Message-Id: <1541407968-31350-1-git-send-email-asmadeus@codewreck.org> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <20181102223908.GA9565@nautica> References: <20181102223908.GA9565@nautica> To: unlisted-recipients:; (no To-header on input) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dominique Martinet If the requested msize is too small (either from command line argument or from the server version reply), we won't get any work done. If it's *really* too small, nothing will work, and this got caught by syzbot recently (on a new kmem_cache_create_usercopy() call) Just set a minimum msize to 4k in both code paths, until someone complains they have a use-case for a smaller msize. We need to check in both mount option and server reply individually because the msize for the first version request would be unchecked with just a global check on clnt->msize. Reported-by: syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com Signed-off-by: Dominique Martinet Cc: Eric Van Hensbergen Cc: Latchesar Ionkov --- net/9p/client.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/9p/client.c b/net/9p/client.c index 2c9a17b9b46b..b1163ebdc622 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -181,6 +181,12 @@ static int parse_opts(char *opts, struct p9_client *clnt) ret = r; continue; } + if (r < 4096) { + p9_debug(P9_DEBUG_ERROR, + "msize should be at least 4k\n"); + ret = -EINVAL; + continue; + } clnt->msize = option; break; case Opt_trans: @@ -983,10 +989,18 @@ static int p9_client_version(struct p9_client *c) else if (!strncmp(version, "9P2000", 6)) c->proto_version = p9_proto_legacy; else { + p9_debug(P9_DEBUG_ERROR, + "server returned an unknown version: %s\n", version); err = -EREMOTEIO; goto error; } + if (msize < 4096) { + p9_debug(P9_DEBUG_ERROR, + "server returned a msize < 4096: %d\n", msize); + err = -EREMOTEIO; + goto error; + } if (msize < c->msize) c->msize = msize; @@ -1043,6 +1057,13 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) if (clnt->msize > clnt->trans_mod->maxsize) clnt->msize = clnt->trans_mod->maxsize; + if (clnt->msize < 4096) { + p9_debug(P9_DEBUG_ERROR, + "Please specify a msize of at least 4k\n"); + err = -EINVAL; + goto free_client; + } + err = p9_client_version(clnt); if (err) goto close_trans; -- 2.19.1