Re: [PATCH 1/5] 9p/virtio: clamp the reply size of a zero-copy request

[sashiko-bot@kernel.org]

> req_done() takes the used length from the device as the reply size
> without checking it against the posted buffers, and p9_check_errors()
> skips its size check for zero-copy requests, so reading an oversized
> error reply to a zero-copy request can overrun the posted buffers:
> 
>   BUG: KASAN: slab-out-of-bounds in handle_rerror+0x144/0x230
>   Read of size 8 at addr ffff888003065768 by task zc9p/157
>   Call Trace:
>    handle_rerror+0x144/0x230
>    p9_virtio_zc_request+0xb8e/0xd70
>    p9_client_zc_rpc+0x21c/0x970
>    p9_client_read_once+0x237/0x6c0
>   The buggy address is located 0 bytes to the right of
>    allocated 8-byte region [ffff888003065760, ffff888003065768)
> 
> [ ... ]
> Closes: https://lore.kernel.org/all/20260607140603.24342-1-zhaoyz24@mails.tsinghua.edu.cn/
> Suggested-by: Dominique Martinet <asmadeus@codewreck.org>
> Fixes: f615625a44c4 ("9p: handling Rerror without copy_from_iter_full()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Lianjie Wang <lian@is.s.u-tokyo.ac.jp>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109105251.2545764-1-lian@is.s.u-tokyo.ac.jp?part=1