From 241d4690122658a3cdb434de4d996ef269d6244d Mon Sep 17 00:00:00 2001 From: Hui Peng Date: Thu, 29 Oct 2026 05:58:00 +0000 Subject: [PATCH] 9p: reject RERROR/RLERROR with zero errcode In p9_check_errors() (net/9p/client.c), a malicious or buggy 9p server returning P9_RERROR or P9_RLERROR with ecode == 0 causes p9_check_errors() to return 0 (success) while leaving the unparsed response payload as if the expected reply message type succeeded. Map ecode == 0 on RERROR / RLERROR to -EPROTO. Link: https://lore.kernel.org/all/20260919221734.3708000-1-benquike@gmail.com/ Signed-off-by: Hui Peng Message-ID: <20261029055801.3-1-asmadeus@codewreck.org> Signed-off-by: Dominique Martinet --- net/9p/client.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/9p/client.c b/net/9p/client.c index ef64546c6d52..e63e8c2a853d 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -448,6 +448,9 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req) p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode); } + if (!err) + err = -EPROTO; + return err; out_err: