[PATCH v4] 9p/trans_virtio: reject mount tags longer than NAME_MAX at probe

[Michael Bommarito]

p9_virtio_probe() reads a 16-bit mount tag length (tag_len) from the
device config and kzalloc()s tag_len + 1 bytes for chan->tag with no
upper bound. A malicious or compromised host can present a tag of up to
65535 bytes; that tag is later copied into the single-page sysfs buffer
by p9_mount_tag_show() (memcpy(buf, chan->tag, tag_len + 1)), a
host-controlled out-of-bounds write of up to ~64 KiB past the PAGE_SIZE
attribute buffer.

Reject an overlong tag at probe time. A 9p mount tag is a name-like
identifier, so bound it by NAME_MAX (255): that limit is independent of
the sysfs/seq_file page size and is far above any legitimate mount tag,
which keeps p9_mount_tag_show() safe at the root without hard-coding a
seq_file implementation detail.

Fixes: 179a5bc4b8cb ("net/9p: use memcpy() instead of snprintf() in p9_mount_tag_show()")
Cc: stable@xxxxxxxxxxxxxxx
Suggested-by: Christian Schoenebeck <linux_oss@xxxxxxxxxxxxx>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@xxxxxxxxx>
---
v4: bound tag_len by NAME_MAX (255) instead of PAGE_SIZE, per Christian
    Schoenebeck's review of v3 -- a 9p mount tag is a name-like identifier, and
    NAME_MAX avoids hard-coding the seq_file page-size implementation detail
    (which could change and silently break the bound) and resolves the
    off-by-one he noted.
v3: reject at probe time (PAGE_SIZE) instead of truncating in show().
v2: sysfs_emit() in show() -- dropped; probe-time rejection preferred.
v1: bound the show() copy.

Build-tested ARCH=um (net/9p/trans_virtio.o, W=1, clean; NAME_MAX resolves with
no new include). The original ~64 KiB OOB write was reproduced pre-fix; with the
probe bound a tag_len > 255 device is refused, so the show handler never sees an
out-of-page tag.

 net/9p/trans_virtio.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index b0d0094ec8e2c..9fa63e3ebf673 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -633,6 +633,11 @@ static int p9_virtio_probe(struct virtio_device *vdev)
 		err = -EINVAL;
 		goto out_free_vq;
 	}
+	if (tag_len > NAME_MAX) {
+		dev_err(&vdev->dev, "mount tag too long (%u bytes)\n", tag_len);
+		err = -EINVAL;
+		goto out_free_vq;
+	}
 	tag = kzalloc(tag_len + 1, GFP_KERNEL);
 	if (!tag) {
 		err = -ENOMEM;

base-commit: 4edcdefd4083ae04b1a5656f4be6cd83ae919ef4
-- 
2.53.0