From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Gertjan Halkes <gertjan@google.com>,
Dominique Martinet <dominique.martinet@cea.fr>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 3.18 077/104] 9p: do not trust pdu content for stat item size
Date: Wed, 24 Apr 2019 19:09:34 +0200 [thread overview]
Message-ID: <20190424170906.721884399@linuxfoundation.org> (raw)
In-Reply-To: <20190424170839.996641496@linuxfoundation.org>
[ Upstream commit 2803cf4379ed252894f046cb8812a48db35294e3 ]
v9fs_dir_readdir() could deadloop if a struct was sent with a size set
to -2
Link: http://lkml.kernel.org/r/1536134432-11997-1-git-send-email-asmadeus@codewreck.org
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88021
Signed-off-by: Gertjan Halkes <gertjan@google.com>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/vfs_dir.c | 8 +++-----
net/9p/protocol.c | 3 ++-
2 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index cfe4cf6486af..fa7d1c3536e6 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -104,7 +104,6 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
int err = 0;
struct p9_fid *fid;
int buflen;
- int reclen = 0;
struct p9_rdir *rdir;
p9_debug(P9_DEBUG_VFS, "name %pD\n", file);
@@ -129,11 +128,10 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
while (rdir->head < rdir->tail) {
err = p9stat_read(fid->clnt, rdir->buf + rdir->head,
rdir->tail - rdir->head, &st);
- if (err) {
+ if (err <= 0) {
p9_debug(P9_DEBUG_VFS, "returned %d\n", err);
return -EIO;
}
- reclen = st.size+2;
over = !dir_emit(ctx, st.name, strlen(st.name),
v9fs_qid2ino(&st.qid), dt_type(&st));
@@ -141,8 +139,8 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
if (over)
return 0;
- rdir->head += reclen;
- ctx->pos += reclen;
+ rdir->head += err;
+ ctx->pos += err;
}
}
}
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index bceb6999614f..66613837b287 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -578,9 +578,10 @@ int p9stat_read(struct p9_client *clnt, char *buf, int len, struct p9_wstat *st)
if (ret) {
p9_debug(P9_DEBUG_9P, "<<< p9stat_read failed: %d\n", ret);
trace_9p_protocol_dump(clnt, &fake_pdu);
+ return ret;
}
- return ret;
+ return fake_pdu.offset;
}
EXPORT_SYMBOL(p9stat_read);
--
2.19.1
next prev parent reply other threads:[~2019-04-24 18:10 UTC|newest]
Thread overview: 112+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-24 17:08 [PATCH 3.18 000/104] 3.18.139-stable review Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 001/104] ext4: cleanup bh release code in ext4_ind_remove_space() Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 002/104] i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 003/104] tracing: kdb: Fix ftdump to not sleep Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 004/104] sysctl: handle overflow for file-max Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 005/104] mm/cma.c: cma_declare_contiguous: correct err handling Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 006/104] mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512! Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 007/104] mm/slab.c: kmemleak no scan alien caches Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 008/104] ocfs2: fix a panic problem caused by o2cb_ctl Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 009/104] cifs: use correct format characters Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 010/104] dm thin: add sanity checks to thin-pool and external snapshot creation Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 011/104] cifs: Fix NULL pointer dereference of devname Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 012/104] fs: fix guard_bio_eod to check for real EOD errors Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 013/104] tools lib traceevent: Fix buffer overflow in arg_eval Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 014/104] scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 015/104] ARM: 8840/1: use a raw_spinlock_t in unwind Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 016/104] mmc: omap: fix the maximum timeout setting Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 017/104] e1000e: Fix -Wformat-truncation warnings Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 018/104] IB/mlx4: Increase the timeout for CM cache Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 019/104] scsi: megaraid_sas: return error when create DMA pool failed Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 020/104] SoC: imx-sgtl5000: add missing put_device() Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 021/104] leds: lp55xx: fix null deref on firmware load failure Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 022/104] kprobes: Prohibit probing on bsearch() Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 023/104] ARM: 8833/1: Ensure that NEON code always compiles with Clang Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 024/104] ALSA: PCM: check if ops are defined before suspending PCM Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 025/104] bcache: fix input overflow to cache set sysfs file io_error_halflife Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 026/104] bcache: fix input overflow to sequential_cutoff Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 027/104] bcache: improve sysfs_strtoul_clamp() Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 028/104] fbdev: fbmem: fix memory access if logo is bigger than the screen Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 029/104] cdrom: Fix race condition in cdrom_sysctl_register Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 030/104] e1000e: fix cyclic resets at link up with active tx Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 031/104] locking/lockdep: Add debug_locks check in __lock_downgrade() Greg Kroah-Hartman
2019-04-24 17:30 ` Tetsuo Handa
2019-04-25 7:56 ` Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 032/104] tty: increase the default flip buffer limit to 2*640K Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 033/104] media: mt9m111: set initial frame size other than 0x0 Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 034/104] hwrng: virtio - Avoid repeated init of completion Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 035/104] hpet: Fix missing = character in the __setup() code of hpet_mmap_enable Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 036/104] dmaengine: imx-dma: fix warning comparison of distinct pointer types Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 037/104] media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 038/104] wlcore: Fix memory leak in case wl12xx_fetch_firmware failure Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 039/104] x86/build: Mark per-CPU symbols as absolute explicitly for LLD Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 040/104] dmaengine: tegra: avoid overflow of byte tracking Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 041/104] drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers Greg Kroah-Hartman
2019-04-24 17:08 ` [PATCH 3.18 042/104] binfmt_elf: switch to new creds when switching to new mm Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 043/104] lib/string.c: implement a basic bcmp Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 044/104] tty: mark Siemens R3964 line discipline as BROKEN Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 045/104] tty: ldisc: add sysctl to prevent autoloading of ldiscs Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 046/104] openvswitch: fix flow actions reallocation Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 047/104] qmi_wwan: add Olicard 600 Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 048/104] sctp: initialize _pad of sockaddr_in before copying to user memory Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 049/104] netns: provide pure entropy for net_hash_mix() Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 050/104] net: ethtool: not call vzalloc for zero sized memory request Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 051/104] ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 052/104] ALSA: seq: Fix OOB-reads from strlcpy Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 053/104] ASoC: fsl_esai: fix channel swap issue when stream starts Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 054/104] block: do not leak memory in bio_copy_user_iov() Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 055/104] arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value Greg Kroah-Hartman
2019-04-24 17:35 ` Nathan Chancellor
2019-04-25 7:51 ` Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 056/104] xen: Prevent buffer overflow in privcmd ioctl Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 057/104] sched/fair: Do not re-read ->h_load_next during hierarchical load calculation Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 058/104] xtensa: fix return_address Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 059/104] PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 060/104] string: drop __must_check from strscpy() and restore strscpy() usages in cgroup Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 061/104] perf/core: Restore mmap record type correctly Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 062/104] ext4: report real fs size after failed resize Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 063/104] ALSA: echoaudio: add a check for ioremap_nocache Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 064/104] ALSA: sb8: add a check for request_region Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 065/104] IB/mlx4: Fix race condition between catas error reset and aliasguid flows Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 066/104] mmc: davinci: remove extraneous __init annotation Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 067/104] ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 068/104] thermal/int340x_thermal: fix mode setting Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 069/104] tools/power turbostat: return the exit status of a command Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 070/104] perf top: Fix error handling in cmd_top() Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 071/104] perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test() Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 072/104] x86/hpet: Prevent potential NULL pointer dereference Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 073/104] x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 074/104] iommu/vt-d: Check capability before disabling protected memory Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 075/104] fix incorrect error code mapping for OBJECTID_NOT_FOUND Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 076/104] rsi: improve kernel thread handling to fix kernel panic Greg Kroah-Hartman
2019-04-24 17:09 ` Greg Kroah-Hartman [this message]
2019-04-24 17:09 ` [PATCH 3.18 078/104] 9p locks: add mount option for lock retry interval Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 079/104] serial: uartps: console_setup() cant be placed to init section Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 080/104] ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 081/104] ACPI / SBS: Fix GPE storm on recent MacBookPros Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 082/104] iommu/dmar: Fix buffer overflow during PCI bus notification Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 083/104] appletalk: Fix use-after-free in atalk_proc_exit Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 084/104] lib/div64.c: off by one in shift Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 085/104] include/linux/swap.h: use offsetof() instead of custom __swapoffset macro Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 086/104] inet: update the IP ID generation algorithm to higher standards Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 087/104] appletalk: Fix compile regression Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 088/104] crypto: crypto4xx - properly set IV after de- and encrypt Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 089/104] tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 090/104] bonding: fix event handling for stacked bonds Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 091/104] net: bridge: multicast: use rcu to access port list from br_multicast_start_querier Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 092/104] ipv4: recompile ip options in ipv4_link_failure Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 093/104] ipv4: ensure rcu_read_lock() in ipv4_link_failure() Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 094/104] tcp: tcp_grow_window() needs to respect tcp_space() Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 095/104] iio: ad_sigma_delta: select channel when reading register Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 096/104] iio: adc: at91: disable adc channel interrupt in timeout case Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 097/104] staging: comedi: vmk80xx: Fix use of uninitialized semaphore Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 098/104] staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 099/104] staging: comedi: ni_usb6501: " Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 100/104] ALSA: core: Fix card races between register and disconnect Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 101/104] x86/kprobes: Verify stack frame on kretprobe Greg Kroah-Hartman
2019-04-24 17:09 ` [PATCH 3.18 102/104] kprobes: Fix error check when reusing optimized probes Greg Kroah-Hartman
2019-04-24 17:10 ` [PATCH 3.18 103/104] sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup Greg Kroah-Hartman
2019-04-24 17:10 ` [PATCH 3.18 104/104] device_cgroup: fix RCU imbalance in error case Greg Kroah-Hartman
2019-04-24 21:45 ` [PATCH 3.18 000/104] 3.18.139-stable review kernelci.org bot
2019-04-25 16:23 ` shuah
2019-04-25 19:36 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190424170906.721884399@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dominique.martinet@cea.fr \
--cc=gertjan@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).