9p/net: put a lower bound on msize (574d356b) · Commits · 戴 / test

If the requested msize is too small (either from command line argument or from the server version reply), we won't get any work done. If it's *really* too small, nothing will work, and this got caught by syzbot recently (on a new kmem_cache_create_usercopy() call) Just set a minimum msize to 4k in both code paths, until someone complains they have a use-case for a smaller msize. We need to check in both mount option and server reply individually because the msize for the first version request would be unchecked with just a global check on clnt->msize. Link: http://lkml.kernel.org/r/1541407968-31350-1-git-send-email-asmadeus@codewreck.org Reported-by:

<syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com> Signed-off-by:

Dominique Martinet <dominique.martinet@cea.fr> Cc: Eric Van Hensbergen <ericvh@gmail.com> Cc: Latchesar Ionkov <lucho@ionkov.net> Cc: stable@vger.kernel.org

net/9p/client.c

+21 −0

Original line number	Diff line number	Diff line
		@@ -181,6 +181,12 @@ static int parse_opts(char opts, struct p9_client clnt)
		ret = r;
		continue;
		}
		if (option < 4096) {
		p9_debug(P9_DEBUG_ERROR,
		"msize should be at least 4k\n");
		ret = -EINVAL;
		continue;
		}
		clnt->msize = option;
		break;
		case Opt_trans:
		@@ -983,10 +989,18 @@ static int p9_client_version(struct p9_client *c)
		else if (!strncmp(version, "9P2000", 6))
		c->proto_version = p9_proto_legacy;
		else {
		p9_debug(P9_DEBUG_ERROR,
		"server returned an unknown version: %s\n", version);
		err = -EREMOTEIO;
		goto error;
		}

		if (msize < 4096) {
		p9_debug(P9_DEBUG_ERROR,
		"server returned a msize < 4096: %d\n", msize);
		err = -EREMOTEIO;
		goto error;
		}
		if (msize < c->msize)
		c->msize = msize;

		@@ -1043,6 +1057,13 @@ struct p9_client p9_client_create(const char dev_name, char *options)
		if (clnt->msize > clnt->trans_mod->maxsize)
		clnt->msize = clnt->trans_mod->maxsize;

		if (clnt->msize < 4096) {
		p9_debug(P9_DEBUG_ERROR,
		"Please specify a msize of at least 4k\n");
		err = -EINVAL;
		goto free_client;
		}

		err = p9_client_version(clnt);
		if (err)
		goto close_trans;

Admin message