Re: [PATCH 5/5] 9p/virtio: keep zero-copy buffers until the device returns them

[sashiko-bot@kernel.org]

> When a fatal signal ends the wait of p9_virtio_zc_request() while the
> device still holds the request, the payload pages are released, and
> p9_client_zc_rpc() returns to its caller once the RFLUSH arrives. Since
> the caller may free the buffers, a misbehaving device can answer the
> request after the RFLUSH and write the reply into freed memory. With the
> payload bounced through swiotlb, the guest itself copies the reply into
> the freed memory when req_done() unmaps the returned buffers:
> 
>   BUG: KASAN: use-after-free in swiotlb_bounce+0x236/0x270
>   Write of size 4080 at addr ffff888004800010 by task swapper/1/0
>   Call Trace:
>    swiotlb_bounce+0x236/0x270
>    req_done+0xb2/0x280
> 
> Fix this by releasing the pages in req_done() once the device returns
> the request, when the wait ends without a reply. req_done() can find the
> pages only through the request, so the page arrays, their page counts
> and need_drop are gathered into struct p9_zc_pages allocated for each
> zero-copy request. p9_client_zc_rpc() now waits until the device returns
> the request, since the caller may reuse or free the buffers after
> p9_client_zc_rpc() returns.
> 
> This patch is assisted by Claude Opus 5.5.
> 
> Fixes: abfa034e4b8e ("fs/9p: Update zero-copy implementation in 9p")
> Cc: stable@vger.kernel.org
> Signed-off-by: Lianjie Wang <lian@is.s.u-tokyo.ac.jp>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109105251.2545764-1-lian@is.s.u-tokyo.ac.jp?part=5