linux-stable.git/net/9p, branch v4.9.136

net/9p: fix error path of p9_virtio_probe

2018-09-15T07:42:58+00:00

[ Upstream commit 92aef4675d5b1b55404e1532379e343bed0e5cf2 ]

Currently when virtio_find_single_vq fails, we go through del_vqs which
throws a warning (Trying to free already-free IRQ).  Skip del_vqs if vq
allocation failed.

Link: http://lkml.kernel.org/r/20180524101021.49880-1-jean-philippe.brucker@arm.com
Signed-off-by: Jean-Philippe Brucker 
Reviewed-by: Greg Kurz 
Cc: Eric Van Hensbergen 
Cc: Ron Minnich 
Cc: Latchesar Ionkov 
Signed-off-by: Andrew Morton 
Signed-off-by: Dominique Martinet 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

net/9p/trans_fd.c: fix race by holding the lock

2018-09-15T07:42:58+00:00

[ Upstream commit 9f476d7c540cb57556d3cc7e78704e6cd5100f5f ]

It may be possible to run p9_fd_cancel() with a deleted req->req_list
and incur in a double del. To fix hold the client->lock while changing
the status, so the other threads will be synchronized.

Link: http://lkml.kernel.org/r/20180723184253.6682-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+735d926e9d1317c3310c@syzkaller.appspotmail.com
To: Eric Van Hensbergen 
To: Ron Minnich 
To: Latchesar Ionkov 
Cc: Yiwen Jiang 
Cc: David S. Miller 
Signed-off-by: Dominique Martinet 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

9p: fix multiple NULL-pointer-dereferences

2018-09-09T18:01:22+00:00

commit 10aa14527f458e9867cf3d2cc6b8cb0f6704448b upstream.

Added checks to prevent GPFs from raising.

Link: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+1a262da37d3bead15c39@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()

2018-09-09T18:01:21+00:00

commit 430ac66eb4c5b5c4eb846b78ebf65747510b30f1 upstream.

The patch adds the flush in p9_mux_poll_stop() as it the function used by
p9_conn_destroy(), in turn called by p9_fd_close() to stop the async
polling associated with the data regarding the connection.

Link: http://lkml.kernel.org/r/20180720092730.27104-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+39749ed7d9ef6dfb23f6@syzkaller.appspotmail.com
To: Eric Van Hensbergen 
To: Ron Minnich 
To: Latchesar Ionkov 
Cc: Yiwen Jiang 
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

net/9p/client.c: version pointer uninitialized

2018-09-09T18:01:20+00:00

commit 7913690dcc5e18e235769fd87c34143072f5dbea upstream.

The p9_client_version() does not initialize the version pointer. If the
call to p9pdu_readf() returns an error and version has not been allocated
in p9pdu_readf(), then the program will jump to the "error" label and will
try to free the version pointer. If version is not initialized, free()
will be called with uninitialized, garbage data and will provoke a crash.

Link: http://lkml.kernel.org/r/20180709222943.19503-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+65c6b72f284a39d416b4@syzkaller.appspotmail.com
Reviewed-by: Jun Piao 
Reviewed-by: Yiwen Jiang 
Cc: Eric Van Hensbergen 
Cc: Ron Minnich 
Cc: Latchesar Ionkov 
Signed-off-by: Andrew Morton 
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

9p/virtio: fix off-by-one error in sg list bounds check

2018-09-09T18:01:20+00:00

commit 23cba9cbde0bba05d772b335fe5f66aa82b9ad19 upstream.

Because the value of limit is VIRTQUEUE_NUM, if index is equal to
limit, it will cause sg array out of bounds, so correct the judgement
of BUG_ON.

Link: http://lkml.kernel.org/r/5B63D5F6.6080109@huawei.com
Signed-off-by: Yiwen Jiang 
Reported-By: Dan Carpenter 
Acked-by: Jun Piao 
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

9p/net: Fix zero-copy path in the 9p virtio transport

2018-09-09T18:01:19+00:00

commit d28c756caee6e414d9ba367d0b92da24145af2a8 upstream.

The zero-copy optimization when reading or writing large chunks of data
is quite useful.  However, the 9p messages created through the zero-copy
write path have an incorrect message size: it should be the size of the
header + size of the data being written but instead it's just the size
of the header.

This only works if the server ignores the size field of the message and
otherwise breaks the framing of the protocol. Fix this by re-writing the
message size field with the correct value.

Tested by running `dd if=/dev/zero of=out bs=4k count=1` inside a
virtio-9p mount.

Link: http://lkml.kernel.org/r/20180717003529.114368-1-chirantan@chromium.org
Signed-off-by: Chirantan Ekbote 
Reviewed-by: Greg Kurz 
Tested-by: Greg Kurz 
Cc: Dylan Reid 
Cc: Guenter Roeck 
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

9p/trans_virtio: discard zero-length reply

2018-02-22T14:43:50+00:00

commit 26d99834f89e76514076d9cd06f61e56e6a509b8 upstream.

When a 9p request is successfully flushed, the server is expected to just
mark it as used without sending a 9p reply (ie, without writing data into
the buffer). In this case, virtqueue_get_buf() will return len == 0 and
we must not report a REQ_STATUS_RCVD status to the client, otherwise the
client will erroneously assume the request has not been flushed.

Cc: stable@vger.kernel.org
Signed-off-by: Greg Kurz 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Greg Kroah-Hartman

net/9p: Switch to wait_event_killable()

2017-11-30T08:39:09+00:00

commit 9523feac272ccad2ad8186ba4fcc89103754de52 upstream.

Because userspace gets Very Unhappy when calls like stat() and execve()
return -EINTR on 9p filesystem mounts. For instance, when bash is
looking in PATH for things to execute and some SIGCHLD interrupts
stat(), bash can throw a spurious 'command not found' since it doesn't
retry the stat().

In practice, hitting the problem is rare and needs a really
slow/bogged down 9p server.

Signed-off-by: Tuomas Tynkkynen 
Signed-off-by: Al Viro 
Signed-off-by: Greg Kroah-Hartman

p9_client_readdir() fix

2017-05-03T15:36:38+00:00

commit 71d6ad08379304128e4bdfaf0b4185d54375423e upstream.

Don't assume that server is sane and won't return more data than
asked for.

Signed-off-by: Al Viro 
Signed-off-by: Greg Kroah-Hartman