linux-stable.git/net/9p, branch v4.9.151

9p/net: put a lower bound on msize

2019-01-13T09:03:52+00:00

commit 574d356b7a02c7e1b01a1d9cba8a26b3c2888f45 upstream.

If the requested msize is too small (either from command line argument
or from the server version reply), we won't get any work done.
If it's *really* too small, nothing will work, and this got caught by
syzbot recently (on a new kmem_cache_create_usercopy() call)

Just set a minimum msize to 4k in both code paths, until someone
complains they have a use-case for a smaller msize.

We need to check in both mount option and server reply individually
because the msize for the first version request would be unchecked
with just a global check on clnt->msize.

Link: http://lkml.kernel.org/r/1541407968-31350-1-git-send-email-asmadeus@codewreck.org
Reported-by: syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com
Signed-off-by: Dominique Martinet 
Cc: Eric Van Hensbergen 
Cc: Latchesar Ionkov 
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman

9p: clear dangling pointers in p9stat_free

2018-11-21T08:25:57+00:00

[ Upstream commit 62e3941776fea8678bb8120607039410b1b61a65 ]

p9stat_free is more of a cleanup function than a 'free' function as it
only frees the content of the struct; there are chances of use-after-free
if it is improperly used (e.g. p9stat_free called twice as it used to be
possible to)

Clearing dangling pointers makes the function idempotent and safer to use.

Link: http://lkml.kernel.org/r/1535410108-20650-2-git-send-email-asmadeus@codewreck.org
Signed-off-by: Dominique Martinet 
Reported-by: syzbot+d4252148d198410b864f@syzkaller.appspotmail.com
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

net/9p: fix error path of p9_virtio_probe

2018-09-15T07:42:58+00:00

[ Upstream commit 92aef4675d5b1b55404e1532379e343bed0e5cf2 ]

Currently when virtio_find_single_vq fails, we go through del_vqs which
throws a warning (Trying to free already-free IRQ).  Skip del_vqs if vq
allocation failed.

Link: http://lkml.kernel.org/r/20180524101021.49880-1-jean-philippe.brucker@arm.com
Signed-off-by: Jean-Philippe Brucker 
Reviewed-by: Greg Kurz 
Cc: Eric Van Hensbergen 
Cc: Ron Minnich 
Cc: Latchesar Ionkov 
Signed-off-by: Andrew Morton 
Signed-off-by: Dominique Martinet 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

net/9p/trans_fd.c: fix race by holding the lock

2018-09-15T07:42:58+00:00

[ Upstream commit 9f476d7c540cb57556d3cc7e78704e6cd5100f5f ]

It may be possible to run p9_fd_cancel() with a deleted req->req_list
and incur in a double del. To fix hold the client->lock while changing
the status, so the other threads will be synchronized.

Link: http://lkml.kernel.org/r/20180723184253.6682-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+735d926e9d1317c3310c@syzkaller.appspotmail.com
To: Eric Van Hensbergen 
To: Ron Minnich 
To: Latchesar Ionkov 
Cc: Yiwen Jiang 
Cc: David S. Miller 
Signed-off-by: Dominique Martinet 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

9p: fix multiple NULL-pointer-dereferences

2018-09-09T18:01:22+00:00

commit 10aa14527f458e9867cf3d2cc6b8cb0f6704448b upstream.

Added checks to prevent GPFs from raising.

Link: http://lkml.kernel.org/r/20180727110558.5479-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+1a262da37d3bead15c39@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()

2018-09-09T18:01:21+00:00

commit 430ac66eb4c5b5c4eb846b78ebf65747510b30f1 upstream.

The patch adds the flush in p9_mux_poll_stop() as it the function used by
p9_conn_destroy(), in turn called by p9_fd_close() to stop the async
polling associated with the data regarding the connection.

Link: http://lkml.kernel.org/r/20180720092730.27104-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+39749ed7d9ef6dfb23f6@syzkaller.appspotmail.com
To: Eric Van Hensbergen 
To: Ron Minnich 
To: Latchesar Ionkov 
Cc: Yiwen Jiang 
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

net/9p/client.c: version pointer uninitialized

2018-09-09T18:01:20+00:00

commit 7913690dcc5e18e235769fd87c34143072f5dbea upstream.

The p9_client_version() does not initialize the version pointer. If the
call to p9pdu_readf() returns an error and version has not been allocated
in p9pdu_readf(), then the program will jump to the "error" label and will
try to free the version pointer. If version is not initialized, free()
will be called with uninitialized, garbage data and will provoke a crash.

Link: http://lkml.kernel.org/r/20180709222943.19503-1-tomasbortoli@gmail.com
Signed-off-by: Tomas Bortoli 
Reported-by: syzbot+65c6b72f284a39d416b4@syzkaller.appspotmail.com
Reviewed-by: Jun Piao 
Reviewed-by: Yiwen Jiang 
Cc: Eric Van Hensbergen 
Cc: Ron Minnich 
Cc: Latchesar Ionkov 
Signed-off-by: Andrew Morton 
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

9p/virtio: fix off-by-one error in sg list bounds check

2018-09-09T18:01:20+00:00

commit 23cba9cbde0bba05d772b335fe5f66aa82b9ad19 upstream.

Because the value of limit is VIRTQUEUE_NUM, if index is equal to
limit, it will cause sg array out of bounds, so correct the judgement
of BUG_ON.

Link: http://lkml.kernel.org/r/5B63D5F6.6080109@huawei.com
Signed-off-by: Yiwen Jiang 
Reported-By: Dan Carpenter 
Acked-by: Jun Piao 
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

9p/net: Fix zero-copy path in the 9p virtio transport

2018-09-09T18:01:19+00:00

commit d28c756caee6e414d9ba367d0b92da24145af2a8 upstream.

The zero-copy optimization when reading or writing large chunks of data
is quite useful.  However, the 9p messages created through the zero-copy
write path have an incorrect message size: it should be the size of the
header + size of the data being written but instead it's just the size
of the header.

This only works if the server ignores the size field of the message and
otherwise breaks the framing of the protocol. Fix this by re-writing the
message size field with the correct value.

Tested by running `dd if=/dev/zero of=out bs=4k count=1` inside a
virtio-9p mount.

Link: http://lkml.kernel.org/r/20180717003529.114368-1-chirantan@chromium.org
Signed-off-by: Chirantan Ekbote 
Reviewed-by: Greg Kurz 
Tested-by: Greg Kurz 
Cc: Dylan Reid 
Cc: Guenter Roeck 
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet 
Signed-off-by: Greg Kroah-Hartman

9p/trans_virtio: discard zero-length reply

2018-02-22T14:43:50+00:00

commit 26d99834f89e76514076d9cd06f61e56e6a509b8 upstream.

When a 9p request is successfully flushed, the server is expected to just
mark it as used without sending a 9p reply (ie, without writing data into
the buffer). In this case, virtqueue_get_buf() will return len == 0 and
we must not report a REQ_STATUS_RCVD status to the client, otherwise the
client will erroneously assume the request has not been flushed.

Cc: stable@vger.kernel.org
Signed-off-by: Greg Kurz 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Greg Kroah-Hartman