summaryrefslogtreecommitdiff
path: root/net/9p/trans_virtio.c
diff options
context:
space:
mode:
authorTomas Bortoli <tomasbortoli@gmail.com>2018-07-23 18:44:04 +0300
committerDominique Martinet <dominique.martinet@cea.fr>2018-08-13 03:34:58 +0300
commitf984579a01d85166ee7380204a96d978a67687a1 (patch)
tree6921952e63cd2ec0cb11625de49fb4395e0d4ce4 /net/9p/trans_virtio.c
parent9f476d7c540cb57556d3cc7e78704e6cd5100f5f (diff)
downloadlinux-f984579a01d85166ee7380204a96d978a67687a1.tar.xz
9p: validate PDU length
This commit adds length check for the PDU size. The size contained in the header has to match the actual size, except for TCP (trans_fd.c) where actual length is not known ahead and the header's length will be checked only against the validity range. Link: http://lkml.kernel.org/r/20180723154404.2406-1-tomasbortoli@gmail.com Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+65c6b72f284a39d416b4@syzkaller.appspotmail.com To: Eric Van Hensbergen <ericvh@gmail.com> To: Ron Minnich <rminnich@sandia.gov> To: Latchesar Ionkov <lucho@ionkov.net> Cc: David S. Miller <davem@davemloft.net> Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Diffstat (limited to 'net/9p/trans_virtio.c')
-rw-r--r--net/9p/trans_virtio.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index d422bfc81eca..06dcd3cc6a29 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -156,8 +156,10 @@ static void req_done(struct virtqueue *vq)
need_wakeup = true;
}
- if (len)
+ if (len) {
+ req->rc->size = len;
p9_client_cb(chan->client, req, REQ_STATUS_RCVD);
+ }
}
spin_unlock_irqrestore(&chan->lock, flags);
/* Wakeup if anyone waiting for VirtIO ring space. */