From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f48.google.com (mail-qv1-f48.google.com [209.85.219.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B513C3F1ADC for ; Fri, 26 Jun 2026 11:19:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782472752; cv=none; b=sQ7q2A+cnAqP7UjciFRNv+gNxltgoXutox1Ua06Be05abbGYBo4zYRe+DQX34cJASemgIQn1D1SMhXWFf0mcrEIqpoa5r36jxjHoIej/STtTjCBwQ10qBp+o7demZUY/Qe3qIWCUhYNdlJLtkHQGBOmSsgPCwCbCeXk9Mw6PFwU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782472752; c=relaxed/simple; bh=2UyjZknl2q29KoZjZWSz+LeCKEJtIqh7DEpIeME1drE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=T3AIDSjcdXwZF8mOxHabokHfk13b8uHTobyH9F0WNSS0HmR1lz5xMfq9t+hgOGf7euHkO4605BAAVKCVKnXdvOjbjWWSGMnBeSrotRuteZly0lHLvZRJi7xxBI4lg7wByOJlGOT6IfZV0Q2roBtcSK6d4YTqDUT+YE/yxzZfr2A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RVUCtpjv; arc=none smtp.client-ip=209.85.219.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RVUCtpjv" Received: by mail-qv1-f48.google.com with SMTP id 6a1803df08f44-8e423029db6so10095016d6.3 for ; Fri, 26 Jun 2026 04:19:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782472750; x=1783077550; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=f0mgUs8CYGhV8MV2nU3223A01RDP1NyxjcxAJ3tAP28=; b=RVUCtpjvRM1qVXH9MSTvAfzcyB2Ga4neSDGA4s2eXT1kpFzX8TaiMgtvwCoKHQHXjj 7eaiUAImdZYfja4NLYDV/S5b9nc1X7wYQGYMOzzFTMMq8v+o4R0gZmNS/r8neGyEvZno CIZ73KjaRuwKUfAyz+p+bgoW04hp68WLQdChGDz+Kjcoc5wsNCUYPGzEZ0hxZVO5JXS9 hTlKwM/iGg/ljpbbBzFTXW+8iZnck2uMh4wJW8DDwK2z3PSddQ4+JdAukgQ5S/KAHbPI n+HpDcebmaD+gr99muzbROJKghtvOuSNqEeJZrtDnWUiwshVwtzOqY7D2YaS8e4C6m+Y VyVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782472750; x=1783077550; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=f0mgUs8CYGhV8MV2nU3223A01RDP1NyxjcxAJ3tAP28=; b=gvYMczhdLF73My9Ba6M6ZCJUs1bnqgFmEpp5lTkuZEA0kg1zMxliZhIKlogx5xonTY eWx4h6SeqfYEIsHCKuMAm0t8mFIlAPp1gY9zFYy3kRuYBf6HvpGzN0ovZXxLvlP+dhhO AqGjwV0F1XVygEDGLCScHR9hflfOawFHweuJD1YGGjNBgDH4QOX6sZzrDeRG7JTtqlKO sEN14ELD6h+s5WKzqMFimILXNDJsqt7BlMw4tzaF6KtjS15vPirGB7pftMHTJkSOq7Rj Bw8UgGxYfgzd/8kStCzXPcyDsju0FP5Kv5RpUT2tOdRXNdrS8JIGz279q+xXgWus6csf 5DaA== X-Forwarded-Encrypted: i=1; AHgh+RrUD1my364koYQTd/6jyx+SpmregCiLD+IS24hq/vV40zI921kML7r7YmFl1GY+ApHU6ZxaLo9B5JpakRw=@vger.kernel.org X-Gm-Message-State: AOJu0YwkkmxDQbRCCkGQkDZr15pltXL7Y3XsdXMF2O23Fd7xdb970NOo JESyuynOSzju2BeHW0GFWGsDJXv7TjW7cpvvAlkDQLVnY15dXnbbWyJZ X-Gm-Gg: AfdE7cksEJTSu1I40kTnvukX/MCTiYDxxvY9RXFA6xRNe/PPO/v2hf2koDaEDoK/Gep MCdhmtTSdwrKqJ7u2LqT1Fp3VOO/btDkmDjMYY1eC5it/CHruWoqilOiETb+atO9Y27uLUNvZ3v YbvvZm41epu9LwRL8AJQyGtyyib22gSKpMOl0/dP2rXv6/6z7nY7JpFpnNlHnw3DJhyRjr/niRx 4h+xFKnn1LJvUhUNVfV+DrEbvzvRGIw59hL4IswnaoAd6vIf9U17N9Fy+bkGxukMvfzzww6LZnh Vv87PilkpgX/WKVub8QP6c4b0Gdb7AbfrhnVGAYzy5irtj09qEJr55qYGXQDsscaxc/SrNevWbP VIpwoZ2MvgL1aEtU24BWUa2W1Vg+4+gvF5tAa/iwiTys/CmiLlU7TNrcFLEtHKy6qU6c/7q2PRX HZDw2fDIJc+GjXV7kBKzQz4lC08SUvLv35i5bGY8raT7AlU6AS3cZuABoyB/SX92P8ZmeW8oFr0 8pX1l3t8mhVS5s69bzDYhWBbaDyMPv5 X-Received: by 2002:a05:6214:4e02:b0:8e7:f480:b180 with SMTP id 6a1803df08f44-8e7f480b8femr45637436d6.11.1782472749589; Fri, 26 Jun 2026 04:19:09 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8df81cdf302sm220342656d6.30.2026.06.26.04.19.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 26 Jun 2026 04:19:08 -0700 (PDT) From: Michael Bommarito To: Eric Van Hensbergen , Latchesar Ionkov , Dominique Martinet , Christian Schoenebeck Cc: v9fs@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH v3] 9p/trans_virtio: reject mount tags that cannot fit a sysfs page Date: Fri, 26 Jun 2026 07:19:06 -0400 Message-ID: <20260626111906.801890-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260610114206.3749904-1-michael.bommarito@gmail.com> References: <20260610114206.3749904-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit p9_virtio_probe() reads the mount tag length from the device's virtio_9p_config.tag_len, a 16-bit field, and accepts any value up to 65535 with no upper bound: virtio_cread(vdev, struct virtio_9p_config, tag_len, &tag_len); ... tag = kzalloc(tag_len + 1, GFP_KERNEL); The tag is later emitted through the world-readable /sys/.../mount_tag attribute by p9_mount_tag_show(), which copies the whole NUL-terminated tag into the single PAGE_SIZE buffer that the sysfs core provides: tag_len = strlen(chan->tag); memcpy(buf, chan->tag, tag_len + 1); A tag longer than the page therefore overruns the sysfs buffer. Under the confidential-computing threat model, where the guest does not trust the host, a malicious or compromised host can advertise a ~64 KiB tag; the first read of mount_tag (udev reads it at probe) then copies host-controlled content past the end of the 4 KiB page, a slab out-of-bounds write. A tag that large can never be rendered through the single-page sysfs attribute and is not usable as a real mount tag, so a tag at or beyond PAGE_SIZE is at best malfunctioning and at worst hostile. Reject such a device at probe time rather than truncating the value in the show handler, which would silently break auto-mount rules that match on the real tag. The probe-time bound makes the existing p9_mount_tag_show() copy safe at its source, so the show handler is left unchanged. Fixes: 179a5bc4b8cb ("net/9p: use memcpy() instead of snprintf() in p9_mount_tag_show()") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito --- v3: Reject an oversized tag at probe time instead of touching the show handler at all, following Christian Schoenebeck's review of v1: a sane 9p device would never use a ~64 KiB tag, silently truncating it (as v1, and as the held v2 sysfs_emit() reroll both did) would break auto-mount rules that match on the real tag, so the device is simply refused. This supersedes the v2 sysfs_emit() patch, which is dropped in favour of the probe-time bound Schoenebeck preferred. v1: https://lore.kernel.org/v9fs/20260610114206.3749904-1-michael.bommarito@gmail.com/ review: https://lore.kernel.org/v9fs/1962500.CQOukoFCf9@weasel/ Compile-tested (ARCH=um, W=1) on torvalds/master, no new warnings. The original overflow was reproduced before the fix with an in-tree KUnit driver under UML+KASAN (a 65535-byte non-NUL tag drove a KASAN slab-out-of-bounds write into the 4 KiB sysfs page). With this patch the probe rejects such a device, so the show handler never sees an out-of-page tag and the memcpy stays in bounds. net/9p/trans_virtio.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c index b0d0094ec8e2c..15568f40509c4 100644 --- a/net/9p/trans_virtio.c +++ b/net/9p/trans_virtio.c @@ -633,6 +633,11 @@ static int p9_virtio_probe(struct virtio_device *vdev) err = -EINVAL; goto out_free_vq; } + if (tag_len >= PAGE_SIZE) { + dev_err(&vdev->dev, "mount tag too long (%u bytes)\n", tag_len); + err = -EINVAL; + goto out_free_vq; + } tag = kzalloc(tag_len + 1, GFP_KERNEL); if (!tag) { err = -ENOMEM; base-commit: 4edcdefd4083ae04b1a5656f4be6cd83ae919ef4 -- 2.53.0