Re: [PATCH 0/3 v2] 9p: Fix write overflow in p9_read_work

[Christian Schoenebeck <linux_oss@crudebyte.com>]

On Thursday, November 17, 2022 10:11:56 AM CET GUO Zihua wrote:
> This patchset fixes the write overflow issue in p9_read_work. As well as
> some follow up cleanups.
> 
> BUG: KASAN: slab-out-of-bounds in _copy_to_iter+0xd35/0x1190
> Write of size 4043 at addr ffff888008724eb1 by task kworker/1:1/24
> 
> CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 6.1.0-rc5-00002-g1adf73218daa-dirty #223
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
> Workqueue: events p9_read_work
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0x4c/0x64
>  print_report+0x178/0x4b0
>  kasan_report+0xae/0x130
>  kasan_check_range+0x179/0x1e0
>  memcpy+0x38/0x60
>  _copy_to_iter+0xd35/0x1190
>  copy_page_to_iter+0x1d5/0xb00
>  pipe_read+0x3a1/0xd90
>  __kernel_read+0x2a5/0x760
>  kernel_read+0x47/0x60
>  p9_read_work+0x463/0x780
>  process_one_work+0x91d/0x1300
>  worker_thread+0x8c/0x1210
>  kthread+0x280/0x330
>  ret_from_fork+0x22/0x30
>  </TASK>
> 
> GUO Zihua (3):
>   9p: Fix write overflow in p9_read_work
>   9p: Remove redundent checks for message size against msize.
>   9p: Use P9_HDRSZ for header size

For entire series:

Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>

I agree with Dominique that patch 1 and 2 should be merged.

>  net/9p/trans_fd.c | 18 +++++++++---------
>  1 file changed, 9 insertions(+), 9 deletions(-)
> 
> ---
> 
> v2:
>   Addition log for debugging similar issues, as well as cleanups according to
>   Dominique's comment.
>