diff options
| author | Dominique Martinet <asmadeus@codewreck.org> | 2025-03-19 14:20:15 +0300 |
|---|---|---|
| committer | Dominique Martinet <asmadeus@codewreck.org> | 2025-03-19 15:19:59 +0300 |
| commit | d0259a856afca31d699b706ed5e2adf11086c73b (patch) | |
| tree | 13d61a66605818ccf7cf2ac8493fa461f32e9940 /drivers/fpga/xilinx-spi.c | |
| parent | 3f61ac7c65bdb26accb52f9db66313597e759821 (diff) | |
| download | linux-d0259a856afca31d699b706ed5e2adf11086c73b.tar.xz | |
9p/net: fix improper handling of bogus negative read/write replies
In p9_client_write() and p9_client_read_once(), if the server
incorrectly replies with success but a negative write/read count then we
would consider written (negative) <= rsize (positive) because both
variables were signed.
Make variables unsigned to avoid this problem.
The reproducer linked below now fails with the following error instead
of a null pointer deref:
9pnet: bogus RWRITE count (4294967295 > 3)
Reported-by: Robert Morris <rtm@mit.edu>
Closes: https://lore.kernel.org/16271.1734448631@26-5-164.dynamic.csail.mit.edu
Message-ID: <20250319-9p_unsigned_rw-v3-1-71327f1503d0@codewreck.org>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Diffstat (limited to 'drivers/fpga/xilinx-spi.c')
0 files changed, 0 insertions, 0 deletions