Re: [PATCH] 9p/trans_virtio: bound RERROR copy by mapped pages

[Dominique Martinet <asmadeus@codewreck.org>]

Yizhou Zhao wrote on Sun, Jun 07, 2026 at 10:06:01PM +0800:
> handle_rerror() copies the variable-length error string of a zero-copy
> RERROR response from the receive pages into the request's static response
> buffer.  The amount copied is bounded by P9_ZC_HDR_SZ, so the data can
> span at most two pages, but the helper is not told how many receive pages
> were actually mapped.
> 
> If a malicious or broken virtio 9p device reports an RERROR length that
> exceeds the remaining bytes in the first mapped receive page, the error
> string is treated as crossing into a second page.  When only one receive
> page was mapped, handle_rerror() still advances the page pointer and
> dereferences the next entry, reading past the allocated in_pages array.

I'm not sure that can actually happen:
If there was an "in page" (if there wasn't this is all noop anyway and
data was written directly to req->rc.sdata), then req->rc.size amount of
data was received into the pages, so if it does happen to span over a
page boundary then there are at least two pages and we don't need to
double-check here.

Christian, do you agree with me this patch is not required?

> Pass the number of mapped receive pages to handle_rerror().  If the error
> string would cross a page boundary but only one page is available, copy the
> bytes that fit in that page and leave the response truncated, matching the
> existing behavior for overlong RERROR messages.  Otherwise continue with
> the second-page copy as before.


-- 
Dominique Martinet | Asmadeus