From 2acd800de8827b7cdce8cb5c2c63b8e8608ec8e3 Mon Sep 17 00:00:00 2001 From: Zhao Zhang Date: Sat, 20 Jun 2026 23:53:03 +0800 Subject: [PATCH] 9p: fix caches_show() out-of-bounds write The sysfs show handler for /sys/fs/9p/caches appends cache tags with snprintf(buf + count, limit, ...) and then advances count and limit by the return value. This is incorrect for truncation because snprintf() returns the full would-have-been length, not the number of bytes stored. Once the accumulated output exceeds PAGE_SIZE, count can advance past the sysfs buffer and limit can become negative. A later iteration then passes an out-of-bounds destination pointer and an oversized size_t into snprintf(), leading to an out-of-bounds write. Use sysfs_emit_at() for the append instead. It follows the sysfs buffer contract and returns the number of bytes actually stored, so the offset remains bounded even when the output is truncated. Fixes: 86db0c32f16c ("9p: fix /sys/fs/9p/caches overwriting itself") Cc: stable@vger.kernel.org Reported-by: Yuan Tan Reported-by: Zhengchuan Liang Reported-by: Xin Liu Assisted-by: Codex:GPT-5.4 Signed-off-by: Zhao Zhang Co-authored-by: Ren Wei Signed-off-by: Ren Wei Message-ID: Signed-off-by: Dominique Martinet --- fs/9p/v9fs.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c index f426cee37414..b30ca5145fae 100644 --- a/fs/9p/v9fs.c +++ b/fs/9p/v9fs.c @@ -17,6 +17,7 @@ #include #include #include +#include #include #include #include @@ -617,21 +618,14 @@ static ssize_t caches_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) { - ssize_t n = 0, count = 0, limit = PAGE_SIZE; + ssize_t count = 0; struct v9fs_session_info *v9ses; spin_lock(&v9fs_sessionlist_lock); list_for_each_entry(v9ses, &v9fs_sessionlist, slist) { - if (v9ses->cachetag) { - n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag); - if (n < 0) { - count = n; - break; - } - - count += n; - limit -= n; - } + if (v9ses->cachetag) + count += sysfs_emit_at(buf, count, "%s\n", + v9ses->cachetag); } spin_unlock(&v9fs_sessionlist_lock);