9p/net: put a lower bound on msize
If the requested msize is too small (either from command line argument or from the server version reply), we won't get any work done. If it's *really* too small, nothing will work, and this got caught by syzbot recently (on a new kmem_cache_create_usercopy() call) Just set a minimum msize to 4k in both code paths, until someone complains they have a use-case for a smaller msize. We need to check in both mount option and server reply individually because the msize for the first version request would be unchecked with just a global check on clnt->msize. Link: http://lkml.kernel.org/r/1541407968-31350-1-git-send-email-asmadeus@codewreck.org Reported-by: syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr> Cc: Eric Van Hensbergen <ericvh@gmail.com> Cc: Latchesar Ionkov <lucho@ionkov.net> Cc: stable@vger.kernel.org
This commit is contained in:
Родитель
52ad259eaa
Коммит
574d356b7a
|
@ -181,6 +181,12 @@ static int parse_opts(char *opts, struct p9_client *clnt)
|
|||
ret = r;
|
||||
continue;
|
||||
}
|
||||
if (option < 4096) {
|
||||
p9_debug(P9_DEBUG_ERROR,
|
||||
"msize should be at least 4k\n");
|
||||
ret = -EINVAL;
|
||||
continue;
|
||||
}
|
||||
clnt->msize = option;
|
||||
break;
|
||||
case Opt_trans:
|
||||
|
@ -983,10 +989,18 @@ static int p9_client_version(struct p9_client *c)
|
|||
else if (!strncmp(version, "9P2000", 6))
|
||||
c->proto_version = p9_proto_legacy;
|
||||
else {
|
||||
p9_debug(P9_DEBUG_ERROR,
|
||||
"server returned an unknown version: %s\n", version);
|
||||
err = -EREMOTEIO;
|
||||
goto error;
|
||||
}
|
||||
|
||||
if (msize < 4096) {
|
||||
p9_debug(P9_DEBUG_ERROR,
|
||||
"server returned a msize < 4096: %d\n", msize);
|
||||
err = -EREMOTEIO;
|
||||
goto error;
|
||||
}
|
||||
if (msize < c->msize)
|
||||
c->msize = msize;
|
||||
|
||||
|
@ -1043,6 +1057,13 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
|
|||
if (clnt->msize > clnt->trans_mod->maxsize)
|
||||
clnt->msize = clnt->trans_mod->maxsize;
|
||||
|
||||
if (clnt->msize < 4096) {
|
||||
p9_debug(P9_DEBUG_ERROR,
|
||||
"Please specify a msize of at least 4k\n");
|
||||
err = -EINVAL;
|
||||
goto free_client;
|
||||
}
|
||||
|
||||
err = p9_client_version(clnt);
|
||||
if (err)
|
||||
goto close_trans;
|
||||
|
|
Загрузка…
Ссылка в новой задаче