linux-stable.git/net/9p, branch v3.16.71

9p/net: fix memory leak in p9_client_create

2019-04-04T15:14:06+00:00

commit bb06c388fa20ae24cfe80c52488de718a7e3a53f upstream.

If msize is less than 4096, we should close and put trans, destroy
tagpool, not just free client. This patch fixes that.

Link: http://lkml.kernel.org/m/1552464097-142659-1-git-send-email-zhengbin13@huawei.com
Fixes: 574d356b7a02 ("9p/net: put a lower bound on msize")
Reported-by: Hulk Robot 
Signed-off-by: zhengbin 
Signed-off-by: Dominique Martinet 
Signed-off-by: Ben Hutchings

9p/net: put a lower bound on msize

2019-04-04T15:14:06+00:00

commit 574d356b7a02c7e1b01a1d9cba8a26b3c2888f45 upstream.

If the requested msize is too small (either from command line argument
or from the server version reply), we won't get any work done.
If it's *really* too small, nothing will work, and this got caught by
syzbot recently (on a new kmem_cache_create_usercopy() call)

Just set a minimum msize to 4k in both code paths, until someone
complains they have a use-case for a smaller msize.

We need to check in both mount option and server reply individually
because the msize for the first version request would be unchecked
with just a global check on clnt->msize.

Link: http://lkml.kernel.org/r/1541407968-31350-1-git-send-email-asmadeus@codewreck.org
Reported-by: syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com
Signed-off-by: Dominique Martinet 
Cc: Eric Van Hensbergen 
Cc: Latchesar Ionkov 
Signed-off-by: Ben Hutchings

9p/virtio: fix off-by-one error in sg list bounds check

2018-12-16T22:08:44+00:00

commit 23cba9cbde0bba05d772b335fe5f66aa82b9ad19 upstream.

Because the value of limit is VIRTQUEUE_NUM, if index is equal to
limit, it will cause sg array out of bounds, so correct the judgement
of BUG_ON.

Link: http://lkml.kernel.org/r/5B63D5F6.6080109@huawei.com
Signed-off-by: Yiwen Jiang 
Reported-By: Dan Carpenter 
Acked-by: Jun Piao 
Signed-off-by: Dominique Martinet 
Signed-off-by: Ben Hutchings

9p: fix multiple NULL-pointer-dereferences

2018-12-16T22:08:44+00:00

commit 10aa14527f458e9867cf3d2cc6b8cb0f6704448b upstream.

Added checks to prevent GPFs from raising.

Link: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+1a262da37d3bead15c39@syzkaller.appspotmail.com
Signed-off-by: Dominique Martinet 
[bwh: Backported to 3.16:
 - Drop changes in trans_xen.c
Signed-off-by: Ben Hutchings

net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()

2018-12-16T22:08:43+00:00

commit 430ac66eb4c5b5c4eb846b78ebf65747510b30f1 upstream.

The patch adds the flush in p9_mux_poll_stop() as it the function used by
p9_conn_destroy(), in turn called by p9_fd_close() to stop the async
polling associated with the data regarding the connection.

Link: http://lkml.kernel.org/r/20180720092730.27104-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+39749ed7d9ef6dfb23f6@syzkaller.appspotmail.com
To: Eric Van Hensbergen 
To: Ron Minnich 
To: Latchesar Ionkov 
Cc: Yiwen Jiang 
Signed-off-by: Dominique Martinet 
Signed-off-by: Ben Hutchings

9p/net: Fix zero-copy path in the 9p virtio transport

2018-12-16T22:08:43+00:00

commit d28c756caee6e414d9ba367d0b92da24145af2a8 upstream.

The zero-copy optimization when reading or writing large chunks of data
is quite useful.  However, the 9p messages created through the zero-copy
write path have an incorrect message size: it should be the size of the
header + size of the data being written but instead it's just the size
of the header.

This only works if the server ignores the size field of the message and
otherwise breaks the framing of the protocol. Fix this by re-writing the
message size field with the correct value.

Tested by running `dd if=/dev/zero of=out bs=4k count=1` inside a
virtio-9p mount.

Link: http://lkml.kernel.org/r/20180717003529.114368-1-chirantan@chromium.org
Signed-off-by: Chirantan Ekbote 
Reviewed-by: Greg Kurz 
Tested-by: Greg Kurz 
Cc: Dylan Reid 
Cc: Guenter Roeck 
Signed-off-by: Dominique Martinet 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

net/9p/client.c: version pointer uninitialized

2018-12-16T22:08:42+00:00

commit 7913690dcc5e18e235769fd87c34143072f5dbea upstream.

The p9_client_version() does not initialize the version pointer. If the
call to p9pdu_readf() returns an error and version has not been allocated
in p9pdu_readf(), then the program will jump to the "error" label and will
try to free the version pointer. If version is not initialized, free()
will be called with uninitialized, garbage data and will provoke a crash.

Link: http://lkml.kernel.org/r/20180709222943.19503-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+65c6b72f284a39d416b4@syzkaller.appspotmail.com
Reviewed-by: Jun Piao 
Reviewed-by: Yiwen Jiang 
Cc: Eric Van Hensbergen 
Cc: Ron Minnich 
Cc: Latchesar Ionkov 
Signed-off-by: Andrew Morton 
Signed-off-by: Dominique Martinet 
Signed-off-by: Ben Hutchings

9p/trans_virtio: discard zero-length reply

2018-06-16T21:22:12+00:00

commit 26d99834f89e76514076d9cd06f61e56e6a509b8 upstream.

When a 9p request is successfully flushed, the server is expected to just
mark it as used without sending a 9p reply (ie, without writing data into
the buffer). In this case, virtqueue_get_buf() will return len == 0 and
we must not report a REQ_STATUS_RCVD status to the client, otherwise the
client will erroneously assume the request has not been flushed.

Signed-off-by: Greg Kurz 
Signed-off-by: Michael S. Tsirkin 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

net/9p: Switch to wait_event_killable()

2018-02-13T18:42:09+00:00

commit 9523feac272ccad2ad8186ba4fcc89103754de52 upstream.

Because userspace gets Very Unhappy when calls like stat() and execve()
return -EINTR on 9p filesystem mounts. For instance, when bash is
looking in PATH for things to execute and some SIGCHLD interrupts
stat(), bash can throw a spurious 'command not found' since it doesn't
retry the stat().

In practice, hitting the problem is rare and needs a really
slow/bogged down 9p server.

Signed-off-by: Tuomas Tynkkynen 
Signed-off-by: Al Viro 
[bwh: Backported to 3.16: drop changes in trans_xen.c]
Signed-off-by: Ben Hutchings

p9_client_readdir() fix

2017-07-18T17:40:36+00:00

commit 71d6ad08379304128e4bdfaf0b4185d54375423e upstream.

Don't assume that server is sane and won't return more data than
asked for.

Signed-off-by: Al Viro 
Signed-off-by: Ben Hutchings