3.18-stable patches

added patches:
	9p-net-put-a-lower-bound-on-msize.patch

diff --git a/queue-3.18/9p-net-put-a-lower-bound-on-msize.patch b/queue-3.18/9p-net-put-a-lower-bound-on-msize.patch
new file mode 100644 (file)
index 0000000..e347aef
--- /dev/null
+++ b/queue-3.18/9p-net-put-a-lower-bound-on-msize.patch
@@ -0,0 +1,81 @@
+From 574d356b7a02c7e1b01a1d9cba8a26b3c2888f45 Mon Sep 17 00:00:00 2001
+From: Dominique Martinet <dominique.martinet@cea.fr>
+Date: Mon, 5 Nov 2018 09:52:48 +0100
+Subject: 9p/net: put a lower bound on msize
+
+From: Dominique Martinet <dominique.martinet@cea.fr>
+
+commit 574d356b7a02c7e1b01a1d9cba8a26b3c2888f45 upstream.
+
+If the requested msize is too small (either from command line argument
+or from the server version reply), we won't get any work done.
+If it's *really* too small, nothing will work, and this got caught by
+syzbot recently (on a new kmem_cache_create_usercopy() call)
+
+Just set a minimum msize to 4k in both code paths, until someone
+complains they have a use-case for a smaller msize.
+
+We need to check in both mount option and server reply individually
+because the msize for the first version request would be unchecked
+with just a global check on clnt->msize.
+
+Link: http://lkml.kernel.org/r/1541407968-31350-1-git-send-email-asmadeus@codewreck.org
+Reported-by: syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com
+Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
+Cc: Eric Van Hensbergen <ericvh@gmail.com>
+Cc: Latchesar Ionkov <lucho@ionkov.net>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/9p/client.c |   21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -155,6 +155,12 @@ static int parse_opts(char *opts, struct
+                               ret = r;
+                               continue;
+                       }
++                      if (option < 4096) {
++                              p9_debug(P9_DEBUG_ERROR,
++                                       "msize should be at least 4k\n");
++                              ret = -EINVAL;
++                              continue;
++                      }
+                       clnt->msize = option;
+                       break;
+               case Opt_trans:
+@@ -979,10 +985,18 @@ static int p9_client_version(struct p9_c
+       else if (!strncmp(version, "9P2000", 6))
+               c->proto_version = p9_proto_legacy;
+       else {
++              p9_debug(P9_DEBUG_ERROR,
++                       "server returned an unknown version: %s\n", version);
+               err = -EREMOTEIO;
+               goto error;
+       }
+ 
++      if (msize < 4096) {
++              p9_debug(P9_DEBUG_ERROR,
++                       "server returned a msize < 4096: %d\n", msize);
++              err = -EREMOTEIO;
++              goto error;
++      }
+       if (msize < c->msize)
+               c->msize = msize;
+ 
+@@ -1047,6 +1061,13 @@ struct p9_client *p9_client_create(const
+       if (clnt->msize > clnt->trans_mod->maxsize)
+               clnt->msize = clnt->trans_mod->maxsize;
+ 
++      if (clnt->msize < 4096) {
++              p9_debug(P9_DEBUG_ERROR,
++                       "Please specify a msize of at least 4k\n");
++              err = -EINVAL;
++              goto free_client;
++      }
++
+       err = p9_client_version(clnt);
+       if (err)
+               goto close_trans;

diff --git a/queue-3.18/series b/queue-3.18/series
index f199d0043349cf1567a41e9f08c52dc41af71a09..328a75aef0c7cb33c6890800525585f65e60f8e3 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -41,3 +41,4 @@ dlm-lost-put_lkb-on-error-path-in-receive_convert-and-receive_unlock.patch
 dlm-memory-leaks-on-error-path-in-dlm_user_request.patch
 gfs2-fix-loop-in-gfs2_rbm_find.patch
 b43-fix-error-in-cordic-routine.patch
+9p-net-put-a-lower-bound-on-msize.patch