Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] net/9p: validate fds in p9_fd_open
To:     Christoph Hellwig <hch@lst.de>, ericvh@gmail.com, lucho@ionkov.net,
        asmadeus@codewreck.org
Cc:     v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        syzbot+e6f77e16ff68b2434a2c@syzkaller.appspotmail.com
References: <20200710085722.435850-1-hch@lst.de>
From:   Doug Nazar <nazard@nazar.ca>
Message-ID: <5bee3e33-2400-2d85-080e-d10cd82b0d85@nazar.ca>
Date:   Fri, 10 Jul 2020 18:56:35 -0400
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:78.0) Gecko/20100101
 Firefox/78.0 Thunderbird/78.0
MIME-Version: 1.0
In-Reply-To: <20200710085722.435850-1-hch@lst.de>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 2020-07-10 04:57, Christoph Hellwig wrote:

> diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
> index 13cd683a658ab6..1cd8ea0e493617 100644
> --- a/net/9p/trans_fd.c
> +++ b/net/9p/trans_fd.c
> @@ -803,20 +803,28 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
>   		return -ENOMEM;
>   
>   	ts->rd = fget(rfd);
> +	if (!ts->rd)
> +		goto out_free_ts;
> +	if (!(ts->rd->f_mode & FMODE_READ))
> +		goto out_put_wr;

		goto out_put_rd;

unless I'm mistaken.

>   	ts->wr = fget(wfd);
> -	if (!ts->rd || !ts->wr) {
> -		if (ts->rd)
> -			fput(ts->rd);
> -		if (ts->wr)
> -			fput(ts->wr);
> -		kfree(ts);
> -		return -EIO;
> -	}
> +	if (!ts->wr)
> +		goto out_put_rd;
> +	if (!(ts->wr->f_mode & FMODE_WRITE))
> +		goto out_put_wr;
>   
>   	client->trans = ts;
>   	client->status = Connected;
>   
>   	return 0;
> +
> +out_put_wr:
> +	fput(ts->wr);
> +out_put_rd:
> +	fput(ts->rd);
> +out_free_ts:
> +	kfree(ts);
> +	return -EIO;
>   }
>   
>   static int p9_socket_open(struct p9_client *client, struct socket *csocket)
> 

Doug