p9_client_readdir() fix

Al Viro · gregkh · commit 91ce8d13faeb · 2017-05-02T21:19:55.000-07:00
commit 71d6ad08379304128e4bdfaf0b4185d54375423e upstream.

Don't assume that server is sane and won't return more data than
asked for.

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
diff --git a/net/9p/client.c b/net/9p/client.c
@@ -2101,6 +2101,10 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset)
 		trace_9p_protocol_dump(clnt, req->rc);
 		goto free_and_error;
 	}
+	if (rsize < count) {
+		pr_err("bogus RREADDIR count (%d > %d)\n", count, rsize);
+		count = rsize;
+	}
 
 	p9_debug(P9_DEBUG_9P, "<<< RREADDIR count %d\n", count);
 

Original file line number	Diff line number	Diff line change
`@@ -2101,6 +2101,10 @@ int p9_client_readdir(struct p9_fid fid, char data, u32 count, u64 offset)`
`2101`	`2101`	`trace_9p_protocol_dump(clnt, req->rc);`
`2102`	`2102`	`goto free_and_error;`
`2103`	`2103`	`}`
	`2104`	`+ if (rsize < count) {`
	`2105`	`+ pr_err("bogus RREADDIR count (%d > %d)\n", count, rsize);`
	`2106`	`+ count = rsize;`
	`2107`	`+ }`
`2104`	`2108`
`2105`	`2109`	`p9_debug(P9_DEBUG_9P, "<<< RREADDIR count %d\n", count);`
`2106`	`2110`