Re: [PATCH v3] 9p/net: fix improper handling of bogus negative read/write replies

[Christian Schoenebeck]

On Wednesday, March 19, 2025 12:20:15 PM CET Dominique Martinet wrote:
> In p9_client_write() and p9_client_read_once(), if the server
> incorrectly replies with success but a negative write/read count then we
> would consider written (negative) <= rsize (positive) because both
> variables were signed.
> 
> Make variables unsigned to avoid this problem.
> 
> The reproducer linked below now fails with the following error instead
> of a null pointer deref:
> 9pnet: bogus RWRITE count (4294967295 > 3)
> 
> Reported-by: Robert Morris <rtm@xxxxxxx>
> Closes: https://lore.kernel.org/16271.1734448631@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Dominique Martinet <asmadeus@xxxxxxxxxxxxx>

Reviewed-by: Christian Schoenebeck <linux_oss@xxxxxxxxxxxxx>

> ---
> Changes in v3:
> - fix bad print formats
> - Link to v2: https://lore.kernel.org/r/20250317-9p_unsigned_rw-v2-1-9d7a94a916ae@xxxxxxxxxxxxx
> 
> Changes in v2:
> - fixed rsize to be u32 instead of size_t
> - Link to v1: https://lore.kernel.org/r/20241222-9p_unsigned_rw-v1-1-3ea971d200cb@xxxxxxxxxxxxx
> ---
>  net/9p/client.c | 30 ++++++++++++++++--------------
>  1 file changed, 16 insertions(+), 14 deletions(-)