| From 9c7e54c7358395dd1b236c67d39f62ef91ea3de0 Mon Sep 17 00:00:00 2001 |
| From: Al Viro <viro@zeniv.linux.org.uk> |
| Date: Fri, 14 Apr 2017 17:22:18 -0400 |
| Subject: [PATCH] p9_client_readdir() fix |
| |
| commit 71d6ad08379304128e4bdfaf0b4185d54375423e upstream. |
| |
| Don't assume that server is sane and won't return more data than |
| asked for. |
| |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/9p/client.c b/net/9p/client.c |
| index 3fc94a49ccd5..cf129fec7329 100644 |
| --- a/net/9p/client.c |
| +++ b/net/9p/client.c |
| @@ -2101,6 +2101,10 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset) |
| trace_9p_protocol_dump(clnt, req->rc); |
| goto free_and_error; |
| } |
| + if (rsize < count) { |
| + pr_err("bogus RREADDIR count (%d > %d)\n", count, rsize); |
| + count = rsize; |
| + } |
| |
| p9_debug(P9_DEBUG_9P, "<<< RREADDIR count %d\n", count); |
| |
| -- |
| 2.12.0 |
| |
