Received: by 2002:a25:5b86:0:0:0:0:0 with SMTP id p128csp2084750ybb; Fri, 29 Mar 2019 18:39:51 -0700 (PDT) X-Google-Smtp-Source: APXvYqywXtxrrzvMfzttCJ4otHMs0fBJSBCH+9/2x+kZM0uwceriXvhmCtG+dLdVM8DUcenrte15 X-Received: by 2002:a62:6f06:: with SMTP id k6mr49818108pfc.257.1553909991453; Fri, 29 Mar 2019 18:39:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553909991; cv=none; d=google.com; s=arc-20160816; b=rKK4NWwMhtyHmEx1ln14kc388Q0mSiXkXV5cWtEah1gTnSUdXk0hzHPhoHpIGrMz4y w2v05izFKRJ+y039oboMk0cCRxMCn7s4pCHMbuJ5NhcfLzWO2YNWHIc4kXpxvQ2WP0KZ VfSNQwY1eTYipwQP7i/rN4EM7JlZbYF8Mujqn1icZPGamkrA0enQFMwu+eYiocJalSe1 3Yfv6C9U1QHZtGAdnN5ttzwrGBSIicGzBgWqosFVRBLdG17z8dOHWQ3kDA0wO5aYhjsw QRRSAruJI2ExWv1Jss0VUSzvSyMgLDfCQMpAvSpIWbutjTjKw5O4m6v9GTUGSDU03t57 zkgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=I/pDfv0JwYDSt9DIicYDX8mCswij2mg8KOiS0AvpRJI=; b=K6t0XsL6eySsNHjZ+Gii6m6fuDL9RX0TiP4jqoIsklH8a7V3mLZ/nB81/e4fp4rW6d 38pgjI5uI3k0RX+IO1Qm5ExZIsjylCslZ45RKKDGa8rIHNlfNA3VXXOGJ7O95xEGE0J0 9/WFZdqW91uwKl3/atLHeN8+h1+6+qJwLxQLcOXJanYv8JtsYJh8FpoMBoUes57NyP/g 9T4STyxiMXPPT9/FVoJ8Q0wzveOnS9QnTEYbsEyBTyeGSWT/1acsx0Zy3ypEyZVnDAbV rP6g9oxJuzRG5ILnaTTTHGsyPAoAt5chyh4nml9n+NWBDG38dwK8uxqwwJIRT9UexPlU E++A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=nahZmmHR; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o9si3148975pgv.25.2019.03.29.18.39.36; Fri, 29 Mar 2019 18:39:51 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=nahZmmHR; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731608AbfC3Ba1 (ORCPT + 99 others); Fri, 29 Mar 2019 21:30:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:37656 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731503AbfC3BaZ (ORCPT ); Fri, 29 Mar 2019 21:30:25 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CE942218D8; Sat, 30 Mar 2019 01:30:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553909424; bh=lENhMCBsYuhXrnuhEosELf/+OFe5LAr2hb0tEln6doU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nahZmmHRN1Php9iKTLznn1n3iR9F+noYbp+6ZdwVn8zEwE2c/ajJcVMDGids5AbCJ 9gQXGWQ9eiKBFTwOnrTcBHBPfR3XlnPhJZj1uHH0cPJpzdmPzGHkDZIdfT6FZc2L/O 7WLUDS61SdgVpKw8rLyXTDp/CFdBVelWdBvxOB/A= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Gertjan Halkes , Dominique Martinet , Sasha Levin , v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.14 03/37] 9p: do not trust pdu content for stat item size Date: Fri, 29 Mar 2019 21:29:46 -0400 Message-Id: <20190330013020.379-3-sashal@kernel.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20190330013020.379-1-sashal@kernel.org> References: <20190330013020.379-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Gertjan Halkes [ Upstream commit 2803cf4379ed252894f046cb8812a48db35294e3 ] v9fs_dir_readdir() could deadloop if a struct was sent with a size set to -2 Link: http://lkml.kernel.org/r/1536134432-11997-1-git-send-email-asmadeus@codewreck.org Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88021 Signed-off-by: Gertjan Halkes Signed-off-by: Dominique Martinet Signed-off-by: Sasha Levin --- fs/9p/vfs_dir.c | 8 +++----- net/9p/protocol.c | 3 ++- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c index 48db9a9f13f9..cb6c4031af55 100644 --- a/fs/9p/vfs_dir.c +++ b/fs/9p/vfs_dir.c @@ -105,7 +105,6 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) int err = 0; struct p9_fid *fid; int buflen; - int reclen = 0; struct p9_rdir *rdir; struct kvec kvec; @@ -138,11 +137,10 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) while (rdir->head < rdir->tail) { err = p9stat_read(fid->clnt, rdir->buf + rdir->head, rdir->tail - rdir->head, &st); - if (err) { + if (err <= 0) { p9_debug(P9_DEBUG_VFS, "returned %d\n", err); return -EIO; } - reclen = st.size+2; over = !dir_emit(ctx, st.name, strlen(st.name), v9fs_qid2ino(&st.qid), dt_type(&st)); @@ -150,8 +148,8 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx) if (over) return 0; - rdir->head += reclen; - ctx->pos += reclen; + rdir->head += err; + ctx->pos += err; } } } diff --git a/net/9p/protocol.c b/net/9p/protocol.c index 9743837aebc6..766d1ef4640a 100644 --- a/net/9p/protocol.c +++ b/net/9p/protocol.c @@ -570,9 +570,10 @@ int p9stat_read(struct p9_client *clnt, char *buf, int len, struct p9_wstat *st) if (ret) { p9_debug(P9_DEBUG_9P, "<<< p9stat_read failed: %d\n", ret); trace_9p_protocol_dump(clnt, &fake_pdu); + return ret; } - return ret; + return fake_pdu.offset; } EXPORT_SYMBOL(p9stat_read); -- 2.19.1