From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f176.google.com (mail-qt1-f176.google.com [209.85.160.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F35FE3A782B for ; Wed, 10 Jun 2026 11:42:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781091733; cv=none; b=WCXJPSF0o6kds/VUdm0ltXPnu4hewkDczjOgU7I+0CroCMQBZ80JLuq3jjF+6o+YqwrwSztKgIZ5Yr7fS9UkhAiTxpbJjIpxCdwpYjzVo5TNrZgFfRV3H6ba94te/UB79LZ3vTINXAYLmFu8rbZR5GcClXl++EimyZ65p3k0yX0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781091733; c=relaxed/simple; bh=jgKmE1kKV3b0d5YkmqgCMwOqD04XBbTPa52jDu60x38=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Tmh0ZOW//oHHNNAG68WpEV8TYCxhVkO4mZeMtWW9pRR/UhG7CO/zvqp4cbfQVy14iPFZFOsZm9hOYT96d6mizDulBts2E2j8gsDhD4lMP0cvqTzzyJZtK80AWInTwGrWZqR6niTftxFGEzrfyW9gmJAZax+3rhrwrl1WUlX1rvg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KTw1L5UK; arc=none smtp.client-ip=209.85.160.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KTw1L5UK" Received: by mail-qt1-f176.google.com with SMTP id d75a77b69052e-517de710886so6741861cf.3 for ; Wed, 10 Jun 2026 04:42:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781091731; x=1781696531; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=6hVbBOpXU3AVgTPjwcETSFcTXwEq2neK+pOPLd5Ot08=; b=KTw1L5UKfMETMIMbJwdr9RWuAotGLadwjsnKaZPnXJTr1zFzGUJRITSqSXtd6YbZIU XKZLDGyIn58qQdWoAdGO0JqYwD0hNeKxQJ8BxBdqeCegL/zP0E3Peq1d89CyCpY67unD mbNeLXa5tSgI/Z7uo9V0htsNydT0hXWwOFpTne1JerpEZ2kKkpuJ9rHwfpmoDQ1XtEFi YJWhE9lGPsR17+9Z4Sxhh5P0ByTPpdzzoSW3xy1fjddZq2lOUnq4l/5Hdj7gP+y1JSLu HAjrf3CLbakmXgi5VuhT6ns4VCExYSRFgfTxLq3GG3CaqZDJqStXXyoR0LzSa6cQegiO PW8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781091731; x=1781696531; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=6hVbBOpXU3AVgTPjwcETSFcTXwEq2neK+pOPLd5Ot08=; b=F4EUfE6lKE2Fwp/IQ4hjQaARMmN4Zcy+QX5eqzUXYdk897izR5wS6a23Q0GFXQudCR MnI0yzDlRFro/3F/Uc8XbAJmsEzqp63R+Y61lekrwwaVJt28N7FulIvTqe/Pn8r+VuN3 z/NmzKOfr7osHgbogHZIyOkaM6NuzdO6DBmpntmosMQiitEw8HximKt2SA3DOo/PZcSb DFDUSouj6Um3+R/ynhV3A7Qhhp8ofiGk4vyVOaj/n9U1bV+PyALpIe/B6KB41fkWpLma 9u/5KNnwoGIjuB07ZWzfHWBN3NFUZ/wg8zWO457hkGmm+zdZ950TYjGGYPJm76xsgPRr Ov6Q== X-Forwarded-Encrypted: i=1; AFNElJ9Fcu0nQew/OjmXMg4VCoI1SG9QX7q6BMa6pdyO95VrvyIt6J06xJlIVAAK7F3PAomtN4o7mtnD/DurOek=@vger.kernel.org X-Gm-Message-State: AOJu0Yy5kKYd9aWqWfeMfmnSMV1fNmoQJizuC7ciKcuyLFWj3SrqxaqO I54n679DSPyLdLyV2NpnPPGCQcLg78fuPO9tr0KuSSh9zJRUweVcmvZI X-Gm-Gg: Acq92OE6RcDJLC2DnckHx9qZQianenU6DF8dfSPVPqF/Od86mrkfEeLpC74ae+oNH9/ Q2yBqYRP8iPLARhYMDtqiwxoM+8NBwLF3bBTPICnapfSiyGT9Z/2/jTfmgvvHbWnOuiPP+r9r1A sQsoQWsWzFCt0i1lZtUdDgQSTx0zzZXM4KETCDZ7tNp4yPEBOeOCbVXWJzAnX1hGUB9Qe/xCThd 725ZHtOIYE3yjSD/csTk5yC6JBpnvPkVBZfyX8zjMXjKA13/qdN1MJvm0FTslerm4ubvm58EpE0 BsX5LUtq085bYwMhTV61R9axvPpN2kmpR/j+rVUFZPSXgQKWmYsXNGwff6/9yalBekSy3Fhp/Wr eTCzRKDGEtIW/jQ6g7pTLRXPaOI1PZhGIJodNffTyGVNDjsq1UkfxNCHHN884jn6qlovUYo3uTP HztD1QXnkMDDDwCN46Fsz0LwRlkQ6Xm/U6iZ2LZF/AAMFrSoHXvtk76iFYrsiE+YD5ZXaYf+V3h VTMYXxsidRsPYJtIpHddbcltk9sH4o= X-Received: by 2002:a05:622a:8d04:b0:517:a02f:171e with SMTP id d75a77b69052e-517a02f1fb5mr305363591cf.30.1781091730803; Wed, 10 Jun 2026 04:42:10 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51775c07e91sm216095931cf.4.2026.06.10.04.42.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Jun 2026 04:42:09 -0700 (PDT) From: Michael Bommarito To: Eric Van Hensbergen , Latchesar Ionkov , Dominique Martinet , Christian Schoenebeck Cc: v9fs@lists.linux.dev, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] 9p/trans_virtio: bound mount_tag show copy to one page Date: Wed, 10 Jun 2026 07:42:06 -0400 Message-ID: <20260610114206.3749904-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit p9_mount_tag_show() copies strlen(chan->tag) + 1 bytes into the single-page buffer the sysfs core provides, with no upper bound. The mount tag length comes from virtio_9p_config.tag_len, a 16-bit field read from the device at probe in p9_virtio_probe() with no cap. Under the confidential-computing threat model, where the guest does not trust the host, a malicious or compromised host can present a 65535-byte tag with no embedded NUL. A read of the world-readable /sys/.../mount_tag attribute (udev reads it at probe) then copies ~64 KiB into the 4 KiB sysfs page, a slab-out-of-bounds write of host-controlled content. Bound the copy to the page size in the show handler. Fixes: 179a5bc4b8cb ("net/9p: use memcpy() instead of snprintf() in p9_mount_tag_show()") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito --- net/9p/trans_virtio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c index 4cdab7094b273..b62aa7b309f1c 100644 --- a/net/9p/trans_virtio.c +++ b/net/9p/trans_virtio.c @@ -573,7 +573,11 @@ static ssize_t p9_mount_tag_show(struct device *dev, chan = vdev->priv; tag_len = strlen(chan->tag); - memcpy(buf, chan->tag, tag_len + 1); + if (tag_len > PAGE_SIZE - 2) + tag_len = PAGE_SIZE - 2; + + memcpy(buf, chan->tag, tag_len); + buf[tag_len] = '\0'; return tag_len + 1; } -- 2.53.0