[PATCH v3 0/3] 9p: handle long directory entry names in readdir

[PATCH v3 0/3] 9p: handle long directory entry names in readdir

[Haobin Wu]

A host directory entry whose name is longer than 255 bytes currently
makes 9p's readdir fail with -EIO and hides every entry after it, which
is how this was noticed on WSL (Plan 9 shares of Windows drives).

Patch 1 drops the copy into the fixed 256-byte p9_dirent::d_name and
uses the string p9pdu_vreadf() already allocated, so the listing no
longer aborts.

Patch 2 then skips entries whose name is longer than NAME_MAX in the
9p2000.L readdir instead of returning them to userspace, as discussed
with Dominique and Jan on v1: the VFS only enforces PATH_MAX in
verify_dirent_name(), and nothing can operate on such a name afterwards
anyway.

Patch 3 applies the same limit to the legacy 9p2000/9p2000.u readdir.
It is a separate commit because it changes behaviour there: such names
used to be listed.

On patch 3, to be explicit about why this is a behaviour change: the
256-byte limit lives in p9dirent_read(), whose only caller is the
9p2000.L path. v9fs_dir_readdir() parses with p9stat_read(), where
p9_wstat::name comes from the 's' conversion (kmalloc(len + 1), no
NAME_MAX check), so legacy really did emit over-long names.

Changes since v2:
- Patch 2: say why the entry is skipped in the debug message and log it
  at P9_DEBUG_ERROR, the level of the strscpy() message it replaces
  (Christian, Dominique).
- New patch 3: same NAME_MAX limit in v9fs_dir_readdir() for legacy
  9p2000(.u), as its own commit (Christian, Dominique).
- Dropped the Assisted-by: trailers.

Changes since v1:
- Use my real name in From/Signed-off-by (Dominique).
- Split into two patches (Dominique).
- Reworded the subject and commit message of patch 1 to describe the
  existing readdir path and clarify that no allocation is added
  (Dominique).
- New patch 2 skipping entries longer than NAME_MAX (Dominique, Jan).
- Dropped the bouncing sripathik@in.ibm.com address from Cc.

v2: https://lore.kernel.org/all/20260916135403.15789-1-853555@gmail.com/
v1: https://lore.kernel.org/all/20260826064819.52523-1-853555@gmail.com/

Haobin Wu (3):
  9p: skip intermediate directory entry name copy in p9dirent_read()
  9p: skip directory entries with names longer than NAME_MAX
  9p: skip over-long directory entry names for legacy 9p2000 too

 fs/9p/vfs_dir.c         | 31 +++++++++++++++++++++++++------
 include/net/9p/client.h |  2 +-
 net/9p/protocol.c       | 12 ++----------
 3 files changed, 28 insertions(+), 17 deletions(-)


base-commit: 028ef9c96e96197026887c0f092424679298aae8
-- 
2.54.0 (Apple Git-157)

[PATCH v3 1/3] 9p: skip intermediate directory entry name copy in p9dirent_read()

[Haobin Wu]

v9fs_dir_readdir_dotl() decodes each entry of a Rreaddir reply with
p9dirent_read(), which parses it through p9pdu_readf("Qqbs"). The 's'
conversion in p9pdu_vreadf() already allocates a NUL-terminated copy
of the name from the wire buffer; p9dirent_read() then strscpy()s that
copy into the fixed 256-byte p9_dirent::d_name and frees the original.

The wire format carries the name length in 16 bits, so a name longer
than 255 bytes is valid on the wire and may well be valid on the
server's filesystem, but it makes strscpy() return -E2BIG.
v9fs_dir_readdir_dotl() turns that into -EIO and aborts getdents64(),
so every entry after the long one disappears from the listing.

Drop the second copy: keep the string allocated by p9pdu_vreadf() in
p9_dirent and let v9fs_dir_readdir_dotl(), its only user, free it once
dir_emit() has consumed it. p9_dirent is a short-lived stack object, so
the string's lifetime does not change.

Note that the VFS only rejects names of PATH_MAX bytes or more in
verify_dirent_name(), so after this change a name between NAME_MAX and
PATH_MAX is returned by getdents64() even though any later lookup on it
fails with -ENAMETOOLONG. The next patch skips such entries.

Fixes: 7751bdb3a095 ("9p: readdir implementation for 9p2000.L")
Closes: https://github.com/microsoft/WSL/issues/41192
Signed-off-by: Haobin Wu <853555@gmail.com>
---
 fs/9p/vfs_dir.c         |  6 +++++-
 include/net/9p/client.h |  2 +-
 net/9p/protocol.c       | 12 ++----------
 3 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index e0d34e4e9076..af00b79d801e 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -185,8 +185,12 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx)
 			if (!dir_emit(ctx, curdirent.d_name,
 				      strlen(curdirent.d_name),
 				      QID2INO(&curdirent.qid),
-				      curdirent.d_type))
+				      curdirent.d_type)) {
+				kfree(curdirent.d_name);
 				return 0;
+			}
+
+			kfree(curdirent.d_name);
 
 			ctx->pos = curdirent.d_off;
 			rdir->head += err;
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index 838a94218b59..9f3079c6f386 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -268,7 +268,7 @@ struct p9_dirent {
 	struct p9_qid qid;
 	u64 d_off;
 	unsigned char d_type;
-	char d_name[256];
+	char *d_name;
 };
 
 struct iov_iter;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 67b0586d807f..d4335884e0c0 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -770,7 +770,7 @@ int p9dirent_read(struct p9_client *clnt, char *buf, int len,
 {
 	struct p9_fcall fake_pdu;
 	int ret;
-	char *nameptr;
+	char *nameptr = NULL;
 
 	fake_pdu.size = len;
 	fake_pdu.capacity = len;
@@ -785,15 +785,7 @@ int p9dirent_read(struct p9_client *clnt, char *buf, int len,
 		return ret;
 	}
 
-	ret = strscpy(dirent->d_name, nameptr, sizeof(dirent->d_name));
-	if (ret < 0) {
-		p9_debug(P9_DEBUG_ERROR,
-			 "On the wire dirent name too long: %s\n",
-			 nameptr);
-		kfree(nameptr);
-		return ret;
-	}
-	kfree(nameptr);
+	dirent->d_name = nameptr;
 
 	return fake_pdu.offset;
 }
-- 
2.54.0 (Apple Git-157)

Re: [PATCH v3 1/3] 9p: skip intermediate directory entry name copy in p9dirent_read()

[Christian Schoenebeck]

On Friday, 18 September 2026 04:48:49 CEST Haobin Wu wrote:
> v9fs_dir_readdir_dotl() decodes each entry of a Rreaddir reply with
> p9dirent_read(), which parses it through p9pdu_readf("Qqbs"). The 's'
> conversion in p9pdu_vreadf() already allocates a NUL-terminated copy
> of the name from the wire buffer; p9dirent_read() then strscpy()s that
> copy into the fixed 256-byte p9_dirent::d_name and frees the original.
> 
> The wire format carries the name length in 16 bits, so a name longer
> than 255 bytes is valid on the wire and may well be valid on the
> server's filesystem, but it makes strscpy() return -E2BIG.
> v9fs_dir_readdir_dotl() turns that into -EIO and aborts getdents64(),
> so every entry after the long one disappears from the listing.
> 
> Drop the second copy: keep the string allocated by p9pdu_vreadf() in
> p9_dirent and let v9fs_dir_readdir_dotl(), its only user, free it once
> dir_emit() has consumed it. p9_dirent is a short-lived stack object, so
> the string's lifetime does not change.
> 
> Note that the VFS only rejects names of PATH_MAX bytes or more in
> verify_dirent_name(), so after this change a name between NAME_MAX and
> PATH_MAX is returned by getdents64() even though any later lookup on it
> fails with -ENAMETOOLONG. The next patch skips such entries.
> 
> Fixes: 7751bdb3a095 ("9p: readdir implementation for 9p2000.L")
> Closes: https://github.com/microsoft/WSL/issues/41192
> Signed-off-by: Haobin Wu <853555@gmail.com>

Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>

> ---
>  fs/9p/vfs_dir.c         |  6 +++++-
>  include/net/9p/client.h |  2 +-
>  net/9p/protocol.c       | 12 ++----------
>  3 files changed, 8 insertions(+), 12 deletions(-)

[PATCH v3 2/3] 9p: skip directory entries with names longer than NAME_MAX

[Haobin Wu]

The 9p wire format carries directory entry names of up to 65535 bytes
and nothing on the client checks them against NAME_MAX. Since the
previous patch, v9fs_dir_readdir_dotl() passes such names straight to
dir_emit(), and the VFS only rejects names of PATH_MAX bytes or more in
verify_dirent_name(), as -EIO, which again fails the whole getdents64()
call.

A name between NAME_MAX and PATH_MAX is therefore returned to userspace
even though every later operation on it fails with -ENAMETOOLONG, and
POSIX requires readdir() to only return components of at most NAME_MAX
bytes. Nothing can use such an entry, so skip it instead of returning it
or failing the listing, reusing the strlen() result that was already
computed for dir_emit(). Log the skipped entry at P9_DEBUG_ERROR, the
same level as the strscpy() failure message this replaces.

Suggested-by: Dominique Martinet <asmadeus@codewreck.org>
Link: https://lore.kernel.org/all/vz5bum547fqyxf5z4m3x7tuqkuq52jlopm65t7hvynqeulh7i3@2t4wnhfxs7qv/
Signed-off-by: Haobin Wu <853555@gmail.com>
---
 fs/9p/vfs_dir.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index af00b79d801e..08d1a3429654 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -173,6 +173,7 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx)
 		}
 
 		while (rdir->head < rdir->tail) {
+			size_t namelen;
 
 			err = p9dirent_read(fid->clnt, rdir->buf + rdir->head,
 					    rdir->tail - rdir->head,
@@ -182,10 +183,14 @@ static int v9fs_dir_readdir_dotl(struct file *file, struct dir_context *ctx)
 				return -EIO;
 			}
 
-			if (!dir_emit(ctx, curdirent.d_name,
-				      strlen(curdirent.d_name),
-				      QID2INO(&curdirent.qid),
-				      curdirent.d_type)) {
+			namelen = strlen(curdirent.d_name);
+			if (namelen > NAME_MAX) {
+				p9_debug(P9_DEBUG_ERROR,
+					 "skip dentry: name length %zu > NAME_MAX\n",
+					 namelen);
+			} else if (!dir_emit(ctx, curdirent.d_name, namelen,
+					     QID2INO(&curdirent.qid),
+					     curdirent.d_type)) {
 				kfree(curdirent.d_name);
 				return 0;
 			}
-- 
2.54.0 (Apple Git-157)

Re: [PATCH v3 2/3] 9p: skip directory entries with names longer than NAME_MAX

[Christian Schoenebeck]

On Friday, 18 September 2026 04:48:50 CEST Haobin Wu wrote:
> The 9p wire format carries directory entry names of up to 65535 bytes
> and nothing on the client checks them against NAME_MAX. Since the
> previous patch, v9fs_dir_readdir_dotl() passes such names straight to
> dir_emit(), and the VFS only rejects names of PATH_MAX bytes or more in
> verify_dirent_name(), as -EIO, which again fails the whole getdents64()
> call.
> 
> A name between NAME_MAX and PATH_MAX is therefore returned to userspace
> even though every later operation on it fails with -ENAMETOOLONG, and
> POSIX requires readdir() to only return components of at most NAME_MAX
> bytes. Nothing can use such an entry, so skip it instead of returning it
> or failing the listing, reusing the strlen() result that was already
> computed for dir_emit(). Log the skipped entry at P9_DEBUG_ERROR, the
> same level as the strscpy() failure message this replaces.
> 
> Suggested-by: Dominique Martinet <asmadeus@codewreck.org>
> Link: https://lore.kernel.org/all/vz5bum547fqyxf5z4m3x7tuqkuq52jlopm65t7hvynqeulh7i3@2t4wnhfxs7qv/ 
> Signed-off-by: Haobin Wu <853555@gmail.com>

Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>

> ---
>  fs/9p/vfs_dir.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)

[PATCH v3 3/3] 9p: skip over-long directory entry names for legacy 9p2000 too

[Haobin Wu]

The legacy 9p2000 and 9p2000.u readdir path, v9fs_dir_readdir(), parses
each entry with p9stat_read() and, unlike the 9p2000.L path, never had
a 256-byte name limit: a name of any length up to the wire maximum was
handed to dir_emit(). getdents64() therefore returned names longer than
NAME_MAX that no later syscall can use, and failed with -EIO for names
of PATH_MAX bytes or more.

Apply the same NAME_MAX check as the previous patch does for
v9fs_dir_readdir_dotl(), so both protocol variants behave the same.

Note that this is a behaviour change for 9p2000 and 9p2000.u: entries
with names longer than NAME_MAX used to be listed and are now skipped.

Suggested-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Link: https://lore.kernel.org/all/3910569.MHq7AAxBmi@weasel/
Signed-off-by: Haobin Wu <853555@gmail.com>
---
 fs/9p/vfs_dir.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index 08d1a3429654..31de9ac913f0 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -119,6 +119,8 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
 			rdir->tail = n;
 		}
 		while (rdir->head < rdir->tail) {
+			size_t namelen;
+
 			err = p9stat_read(fid->clnt, rdir->buf + rdir->head,
 					  rdir->tail - rdir->head, &st);
 			if (err <= 0) {
@@ -126,8 +128,16 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
 				return -EIO;
 			}
 
-			over = !dir_emit(ctx, st.name, strlen(st.name),
-					QID2INO(&st.qid), dt_type(&st));
+			namelen = strlen(st.name);
+			if (namelen > NAME_MAX) {
+				p9_debug(P9_DEBUG_ERROR,
+					 "skip dentry: name length %zu > NAME_MAX\n",
+					 namelen);
+				over = false;
+			} else {
+				over = !dir_emit(ctx, st.name, namelen,
+						 QID2INO(&st.qid), dt_type(&st));
+			}
 			p9stat_free(&st);
 			if (over)
 				return 0;
-- 
2.54.0 (Apple Git-157)

Re: [PATCH v3 3/3] 9p: skip over-long directory entry names for legacy 9p2000 too

[Christian Schoenebeck]

On Friday, 18 September 2026 04:48:51 CEST Haobin Wu wrote:
> The legacy 9p2000 and 9p2000.u readdir path, v9fs_dir_readdir(), parses
> each entry with p9stat_read() and, unlike the 9p2000.L path, never had
> a 256-byte name limit: a name of any length up to the wire maximum was
> handed to dir_emit(). getdents64() therefore returned names longer than
> NAME_MAX that no later syscall can use, and failed with -EIO for names
> of PATH_MAX bytes or more.
> 
> Apply the same NAME_MAX check as the previous patch does for
> v9fs_dir_readdir_dotl(), so both protocol variants behave the same.
> 
> Note that this is a behaviour change for 9p2000 and 9p2000.u: entries
> with names longer than NAME_MAX used to be listed and are now skipped.

That sentence is a bit misleading, isn't it?

Name length 256..4095:
  - before: listed, but unusable (ENAMETOOLONG)
  - now: entry skipped, fetch continues

Name length >=4096:
  - before: aborts the entire fetch (similar to 9p2000.L side)
  - now: entry skipped, fetch continues

But yes, it would be a user-space change nevertheless, so ...
 
> Suggested-by: Christian Schoenebeck <linux_oss@crudebyte.com>
> Link: https://lore.kernel.org/all/3910569.MHq7AAxBmi@weasel/
> Signed-off-by: Haobin Wu <853555@gmail.com>
> ---
>  fs/9p/vfs_dir.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
> index 08d1a3429654..31de9ac913f0 100644
> --- a/fs/9p/vfs_dir.c
> +++ b/fs/9p/vfs_dir.c
> @@ -119,6 +119,8 @@ static int v9fs_dir_readdir(struct file *file, struct
> dir_context *ctx) rdir->tail = n;
>  		}
>  		while (rdir->head < rdir->tail) {
> +			size_t namelen;
> +
>  			err = p9stat_read(fid->clnt, rdir->buf + rdir->head,
>  					  rdir->tail - rdir->head, &st);
>  			if (err <= 0) {
> @@ -126,8 +128,16 @@ static int v9fs_dir_readdir(struct file *file, struct
> dir_context *ctx) return -EIO;
>  			}
> 
> -			over = !dir_emit(ctx, st.name, strlen(st.name),
> -					QID2INO(&st.qid), dt_type(&st));
> +			namelen = strlen(st.name);
> +			if (namelen > NAME_MAX) {

... maybe better if (namelen >= PATH_MAX) here for legacy 9p2000(.u)?

> +				p9_debug(P9_DEBUG_ERROR,
> +					 "skip dentry: name length %zu > NAME_MAX\n",
> +					 namelen);
> +				over = false;

Nit: alternative would be init over = false and dropping explicit assignment 
inside loop branch here. But that's already personal taste level.

/Christian

> +			} else {
> +				over = !dir_emit(ctx, st.name, namelen,
> +						 QID2INO(&st.qid), dt_type(&st));
> +			}
>  			p9stat_free(&st);
>  			if (over)
>  				return 0;