[PATCH] 9p: reject RERROR/RLERROR with zero errcode and guard 0-link drop_nlink()

[PATCH] 9p: reject RERROR/RLERROR with zero errcode and guard 0-link drop_nlink()

[Hui Peng]

Fix two issues in 9p client and VFS inode handling:

1. In p9_check_errors() (net/9p/client.c), a malicious or buggy 9p
   server returning P9_RERROR or P9_RLERROR with ecode == 0 causes
   p9_check_errors() to return 0 (success) while leaving the unparsed
   response payload as if the expected reply message type succeeded. Map
   ecode == 0 on RERROR / RLERROR to -EPROTO.
2. In v9fs_dec_count() (fs/9p/vfs_inode.c), only call drop_nlink() when
   inode->i_nlink > 0 so unlinking an inode whose server-reported nlink
   was already 0 does not underflow i_nlink and trigger
   WARN_ON(inode->i_nlink == 0).

Fixes: bd238fb431f3 ("9p: Reorganization of 9p file system code")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 3829554ca369..12db5ff61554 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -503,7 +503,7 @@ static void v9fs_dec_count(struct inode *inode)
 
 	if (!(v9ses->cache & (CACHE_META | CACHE_LOOSE)))
 		return;
-	if (!S_ISDIR(inode->i_mode) || inode->i_nlink > 2)
+	if (S_ISDIR(inode->i_mode) ? inode->i_nlink > 2 : inode->i_nlink > 0)
 		drop_nlink(inode);
 }
 
diff --git a/net/9p/client.c b/net/9p/client.c
index ef64546c6d52..e63e8c2a853d 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -448,6 +448,9 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
 		p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode);
 	}
 
+	if (!err)
+		err = -EPROTO;
+
 	return err;
 
 out_err:

Re: [PATCH] 9p: reject RERROR/RLERROR with zero errcode and guard 0-link drop_nlink()

[Dominique Martinet]

Hui Peng wrote on Sat, Sep 19, 2026 at 10:17:34PM +0000:
> Fix two issues in 9p client and VFS inode handling:

Please split this in two commits.

> 1. In p9_check_errors() (net/9p/client.c), a malicious or buggy 9p
>    server returning P9_RERROR or P9_RLERROR with ecode == 0 causes
>    p9_check_errors() to return 0 (success) while leaving the unparsed
>    response payload as if the expected reply message type succeeded. Map
>    ecode == 0 on RERROR / RLERROR to -EPROTO.

Sure

> 2. In v9fs_dec_count() (fs/9p/vfs_inode.c), only call drop_nlink() when
>    inode->i_nlink > 0 so unlinking an inode whose server-reported nlink
>    was already 0 does not underflow i_nlink and trigger
>    WARN_ON(inode->i_nlink == 0).

I'm pretty sure this is racy but the dir case already is anyway, so meh,
why not, ok.

-- 
Dominique Martinet | Asmadeus