Re: [PATCH v4] 9p/trans_virtio: reject mount tags longer than NAME_MAX at probe

[Christian Schoenebeck]

On Saturday, 27 June 2026 23:10:12 CEST Michael Bommarito wrote:
> p9_virtio_probe() reads a 16-bit mount tag length (tag_len) from the
> device config and kzalloc()s tag_len + 1 bytes for chan->tag with no
> upper bound. A malicious or compromised host can present a tag of up to
> 65535 bytes; that tag is later copied into the single-page sysfs buffer
> by p9_mount_tag_show() (memcpy(buf, chan->tag, tag_len + 1)), a
> host-controlled out-of-bounds write of up to ~64 KiB past the PAGE_SIZE
> attribute buffer.
> 
> Reject an overlong tag at probe time. A 9p mount tag is a name-like
> identifier, so bound it by NAME_MAX (255): that limit is independent of
> the sysfs/seq_file page size and is far above any legitimate mount tag,
> which keeps p9_mount_tag_show() safe at the root without hard-coding a
> seq_file implementation detail.
> 
> Fixes: 179a5bc4b8cb ("net/9p: use memcpy() instead of snprintf() in
> p9_mount_tag_show()") Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Christian Schoenebeck <linux_oss@xxxxxxxxxxxxx>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Michael Bommarito <michael.bommarito@xxxxxxxxx>

Reviewed-by: Christian Schoenebeck <linux_oss@xxxxxxxxxxxxx>

> ---
> v4: bound tag_len by NAME_MAX (255) instead of PAGE_SIZE, per Christian
>     Schoenebeck's review of v3 -- a 9p mount tag is a name-like identifier,
> and NAME_MAX avoids hard-coding the seq_file page-size implementation
> detail (which could change and silently break the bound) and resolves the
> off-by-one he noted.
> v3: reject at probe time (PAGE_SIZE) instead of truncating in show().
> v2: sysfs_emit() in show() -- dropped; probe-time rejection preferred.
> v1: bound the show() copy.
> 
> Build-tested ARCH=um (net/9p/trans_virtio.o, W=1, clean; NAME_MAX resolves
> with no new include). The original ~64 KiB OOB write was reproduced
> pre-fix; with the probe bound a tag_len > 255 device is refused, so the
> show handler never sees an out-of-page tag.
> 
>  net/9p/trans_virtio.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
> index b0d0094ec8e2c..9fa63e3ebf673 100644
> --- a/net/9p/trans_virtio.c
> +++ b/net/9p/trans_virtio.c
> @@ -633,6 +633,11 @@ static int p9_virtio_probe(struct virtio_device *vdev)
>  		err = -EINVAL;
>  		goto out_free_vq;
>  	}
> +	if (tag_len > NAME_MAX) {
> +		dev_err(&vdev->dev, "mount tag too long (%u bytes)\n", tag_len);
> +		err = -EINVAL;
> +		goto out_free_vq;
> +	}
>  	tag = kzalloc(tag_len + 1, GFP_KERNEL);
>  	if (!tag) {
>  		err = -ENOMEM;
> 
> base-commit: 4edcdefd4083ae04b1a5656f4be6cd83ae919ef4