Re: p9_client_write doesn't check for negative "written" from server

[Dominique Martinet <asmadeus@codewreck.org>]

Hi,

rtm@csail.mit.edu wrote on Tue, Dec 17, 2024 at 10:17:11AM -0500:
> If the kernel's 9p client sends a write request, and the server returns
> a successful Rwrite reply, but with a negative "written" value, then
> this line towards the end of p9_client_write():
> 
>                 iov_iter_revert(from, count - written - iov_iter_count(from));
> 
> can pass an unroll argument to iov_iter_revert() that's larger than
> the number of bytes in the iov

Thanks for the report, I'm surprised this didn't come up sooner through
syzbot...

That is correct, written (and simlarily received in p9_client_read_once)
should be made unsigned.
They're actually compared with 'rsize' which is an int but is set from
fid->iounit which is a u32, so just making these three variables u32
will sort the issue.

The patch is trivial so would you like to send it?
If you don't want to (or there is no reply in a while) then I'll send a
patch this weekend crediting you as reported-by.
-- 
Dominique