github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

9p: reject RERROR/RLERROR with zero errcode

Browse Source 
In p9_check_errors() (net/9p/client.c), a malicious or buggy 9p server
returning P9_RERROR or P9_RLERROR with ecode == 0 causes
p9_check_errors() to return 0 (success) while leaving the unparsed
response payload as if the expected reply message type succeeded.

Map ecode == 0 on RERROR / RLERROR to -EPROTO.

Link: https://lore.kernel.org/all/20260919221734.3708000-1-benquike@gmail.com/
Signed-off-by: Hui Peng <benquike@gmail.com>
Message-ID: <20261029055801.3-1-asmadeus@codewreck.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
This commit is contained in:
Hui Peng 2026-10-29 05:58:00 +00:00 committed by Dominique Martinet
parent 56894cadf2
commit 241d469012
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/9p/client.c
View File

@ -448,6 +448,9 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode);
}
if (!err)
err = -EPROTO;
return err;
out_err: