From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 11 Jan 2019 10:06:02 +0000 (+0100)
Subject: 4.4-stable patches
X-Git-Tag: v4.20.2~20
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fc6aabfbdaa3f6cf14e1ad826dd9294f38407e91;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	9p-net-put-a-lower-bound-on-msize.patch
---

diff --git a/queue-4.4/9p-net-put-a-lower-bound-on-msize.patch b/queue-4.4/9p-net-put-a-lower-bound-on-msize.patch
new file mode 100644
index 00000000000..d30cfbd5b96
--- /dev/null
+++ b/queue-4.4/9p-net-put-a-lower-bound-on-msize.patch
@@ -0,0 +1,81 @@
+From 574d356b7a02c7e1b01a1d9cba8a26b3c2888f45 Mon Sep 17 00:00:00 2001
+From: Dominique Martinet <dominique.martinet@cea.fr>
+Date: Mon, 5 Nov 2018 09:52:48 +0100
+Subject: 9p/net: put a lower bound on msize
+
+From: Dominique Martinet <dominique.martinet@cea.fr>
+
+commit 574d356b7a02c7e1b01a1d9cba8a26b3c2888f45 upstream.
+
+If the requested msize is too small (either from command line argument
+or from the server version reply), we won't get any work done.
+If it's *really* too small, nothing will work, and this got caught by
+syzbot recently (on a new kmem_cache_create_usercopy() call)
+
+Just set a minimum msize to 4k in both code paths, until someone
+complains they have a use-case for a smaller msize.
+
+We need to check in both mount option and server reply individually
+because the msize for the first version request would be unchecked
+with just a global check on clnt->msize.
+
+Link: http://lkml.kernel.org/r/1541407968-31350-1-git-send-email-asmadeus@codewreck.org
+Reported-by: syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com
+Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
+Cc: Eric Van Hensbergen <ericvh@gmail.com>
+Cc: Latchesar Ionkov <lucho@ionkov.net>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/9p/client.c |   21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -156,6 +156,12 @@ static int parse_opts(char *opts, struct
+ 				ret = r;
+ 				continue;
+ 			}
++			if (option < 4096) {
++				p9_debug(P9_DEBUG_ERROR,
++					 "msize should be at least 4k\n");
++				ret = -EINVAL;
++				continue;
++			}
+ 			clnt->msize = option;
+ 			break;
+ 		case Opt_trans:
+@@ -972,10 +978,18 @@ static int p9_client_version(struct p9_c
+ 	else if (!strncmp(version, "9P2000", 6))
+ 		c->proto_version = p9_proto_legacy;
+ 	else {
++		p9_debug(P9_DEBUG_ERROR,
++			 "server returned an unknown version: %s\n", version);
+ 		err = -EREMOTEIO;
+ 		goto error;
+ 	}
+ 
++	if (msize < 4096) {
++		p9_debug(P9_DEBUG_ERROR,
++			 "server returned a msize < 4096: %d\n", msize);
++		err = -EREMOTEIO;
++		goto error;
++	}
+ 	if (msize < c->msize)
+ 		c->msize = msize;
+ 
+@@ -1040,6 +1054,13 @@ struct p9_client *p9_client_create(const
+ 	if (clnt->msize > clnt->trans_mod->maxsize)
+ 		clnt->msize = clnt->trans_mod->maxsize;
+ 
++	if (clnt->msize < 4096) {
++		p9_debug(P9_DEBUG_ERROR,
++			 "Please specify a msize of at least 4k\n");
++		err = -EINVAL;
++		goto free_client;
++	}
++
+ 	err = p9_client_version(clnt);
+ 	if (err)
+ 		goto close_trans;
diff --git a/queue-4.4/series b/queue-4.4/series
index 41b0e2a2525..925a549f3c8 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -79,4 +79,5 @@ dlm-lost-put_lkb-on-error-path-in-receive_convert-and-receive_unlock.patch
 dlm-memory-leaks-on-error-path-in-dlm_user_request.patch
 gfs2-fix-loop-in-gfs2_rbm_find.patch
 b43-fix-error-in-cordic-routine.patch
+9p-net-put-a-lower-bound-on-msize.patch
 vhost-vsock-fix-uninitialized-vhost_vsock-guest_cid.patch