Re: [PATCH 2/5] 9p: ignore a zero-copy reply that arrives after a fatal signal

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] net/9p: uninitialized stack memory read in p9_check_errors()
  [1]
--

commit ef137edd1ee785bfc27fe33c6494662e5a3cdca5
Author: Lianjie Wang <lian@is.s.u-tokyo.ac.jp>

9p: ignore a zero-copy reply that arrives after a fatal signal

This commit keeps err as -ERESTARTSYS in p9_client_zc_rpc() when a zero-copy
request is interrupted by a fatal signal, avoiding parsing an incomplete or
unbounded reply in p9_check_errors().

> diff --git a/net/9p/client.c b/net/9p/client.c
> index e63e8c2a853df..66980ad52bca8 100644
> --- a/net/9p/client.c
> +++ b/net/9p/client.c
> @@ -706,10 +706,11 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
>  
>  		if (c->trans_mod->cancel(c, req))
>  			p9_client_flush(c, req);
> -
> -		/* if we received the response anyway, don't signal error */
> -		if (READ_ONCE(req->status) == REQ_STATUS_RCVD)
> -			err = 0;
> +		/*
> +		 * err stays -ERESTARTSYS even if the reply has arrived, since
> +		 * the transport moves the error string of a zero-copy reply
> +		 * into rc only while it waits.
> +		 */
>  	}
>  recalc_sigpending:
>  	if (sigpending) {

[Severity: Medium]
This problem wasn't introduced by this patch, but can p9_check_errors() read
uninitialized stack memory from ecode [1] when logging a legacy 9P2000
RERROR response?

net/9p/client.c:p9_check_errors() {
	...
	int ecode;
	...
	if (!p9_is_proto_dotl(c)) {
		char *ename = NULL;

		err = p9pdu_readf(&req->rc, c->proto_version, "s?d",
				  &ename, &ecode);
		...
		if (!err) {
			err = p9_errstr2errno(ename, strlen(ename));

			p9_debug(P9_DEBUG_9P, "<<< RERROR (%d) %s\n",
				 -ecode, ename);
		}
	...
}

Under legacy 9P2000, p9pdu_readf() stops at the '?' modifier in "s?d" and
returns 0 without writing to ecode, so p9_debug() formats uninitialized stack
memory into the debug log when CONFIG_NET_9P_DEBUG is enabled.

[1] https://sashiko.dev/#/bug/linux-cfaf1e1d-d65e-44c0-a62c-a97caf427656

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109105251.2545764-1-lian@is.s.u-tokyo.ac.jp?part=2