Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e0c47a51 authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Greg Kroah-Hartman
Browse files

net/9p: validate fds in p9_fd_open 

[ Upstream commit a39c46067c845a8a2d7144836e9468b7f072343e ]

p9_fd_open just fgets file descriptors passed in from userspace, but
doesn't verify that they are valid for read or writing.  This gets
cought down in the VFS when actually attempting a read or write, but
a new warning added in linux-next upsets syzcaller.

Fix this by just verifying the fds early on.

Link: http://lkml.kernel.org/r/20200710085722.435850-1-hch@lst.de


Reported-by: default avatar <syzbot+e6f77e16ff68b2434a2c@syzkaller.appspotmail.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
[Dominique: amend goto as per Doug Nazar's review]
Signed-off-by: default avatarDominique Martinet <asmadeus@codewreck.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent fe6402e0

net/9p/trans_fd.c

+16 −8
Original line number Diff line number Diff line
@@ -816,20 +816,28 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd) 
		return -ENOMEM;



	ts->rd = fget(rfd);

	if (!ts->rd)

		goto out_free_ts;

	if (!(ts->rd->f_mode & FMODE_READ))

		goto out_put_rd;

	ts->wr = fget(wfd);

	if (!ts->rd || !ts->wr) {

		if (ts->rd)

			fput(ts->rd);

		if (ts->wr)

			fput(ts->wr);

		kfree(ts);

		return -EIO;

	}

	if (!ts->wr)

		goto out_put_rd;

	if (!(ts->wr->f_mode & FMODE_WRITE))

		goto out_put_wr;



	client->trans = ts;

	client->status = Connected;



	return 0;



out_put_wr:

	fput(ts->wr);

out_put_rd:

	fput(ts->rd);

out_free_ts:

	kfree(ts);

	return -EIO;

}



static int p9_socket_open(struct p9_client *client, struct socket *csocket)