On Mon, Aug 15, 2022 at 08:49:25PM -0500, Tyler Hicks wrote: > [ Upstream commit aa7aeee169480e98cf41d83c01290a37e569be6d ] > > Ensure that the fid's iounit field is set to zero when a new fid is > created. Certain 9P operations, such as OPEN and CREATE, allow the > server to reply with an iounit size which the client code assigns to the > p9_fid struct shortly after the fid is created by p9_fid_create(). On > the other hand, an XATTRWALK operation doesn't allow for the server to > specify an iounit value. The iounit field of the newly allocated p9_fid > struct remained uninitialized in that case. Depending on allocation > patterns, the iounit value could have been something reasonable that was > carried over from previously freed fids or, in the worst case, could > have been arbitrary values from non-fid related usages of the memory > location. > > The bug was detected in the Windows Subsystem for Linux 2 (WSL2) kernel > after the uninitialized iounit field resulted in the typical sequence of > two getxattr(2) syscalls, one to get the size of an xattr and another > after allocating a sufficiently sized buffer to fit the xattr value, to > hit an unexpected ERANGE error in the second call to getxattr(2). An > uninitialized iounit field would sometimes force rsize to be smaller > than the xattr value size in p9_client_read_once() and the 9P server in > WSL refused to chunk up the READ on the attr_fid and, instead, returned > ERANGE to the client. The virtfs server in QEMU seems happy to chunk up > the READ and this problem goes undetected there. > > Link: https://lkml.kernel.org/r/20220710141402.803295-1-tyhicks@xxxxxxxxxxxxxxxxxxx > Fixes: ebf46264a004 ("fs/9p: Add support user. xattr") > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Tyler Hicks <tyhicks@xxxxxxxxxxxxxxxxxxx> > Reviewed-by: Christian Schoenebeck <linux_oss@xxxxxxxxxxxxx> > Signed-off-by: Dominique Martinet <asmadeus@xxxxxxxxxxxxx> > [tyhicks: Adjusted context due to: > - Lack of fid refcounting introduced in v5.11 commit 6636b6dcc3db ("9p: > add refcount to p9_fid struct") > - Difference in how buffer sizes are specified v5.16 commit > 6e195b0f7c8e ("9p: fix a bunch of checkpatch warnings")] > Signed-off-by: Tyler Hicks <tyhicks@xxxxxxxxxxxxxxxxxxx> > --- > > Tested on top of v5.10.136. Verified to apply to v5.4 and v4.19 and the > resulting code was read for correctness. > All now queued up, thanks. greg k-h
