Re: [syzbot] [v9fs?] UBSAN: shift-out-of-bounds in v9fs_get_tree

Hillf Danton
2025-08-21T08:48:03Z

On Wed, Aug 20, 2025 at 07:58:31PM -0700:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3ac864c2d9bb Add linux-next specific files for 20250818
> git tree: linux-next
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=13706442580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=6d1acc6b9e1fca1b
> dashboard link: https://syzkaller.appspot.com/bug?extid=30c83da54e948f6e9436
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=141586f0580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=124c9ba2580000

#syz test

--- x/fs/9p/v9fs.c
+++ y/fs/9p/v9fs.c
@@ -302,6 +302,8 @@ int v9fs_parse_param(struct fs_context *
p9_debug(P9_DEBUG_ERROR, "msize should be at least 4k\n");
return -EINVAL;
}
+ if (result.uint_32 < P9_IOHDRSZ)
+ return -EINVAL;
clnt->msize = result.uint_32;
break;
case Opt_trans:
--