net/9p: insulate the client against an invalid error code sent by a 9p server

A looney tunes server sending an invalid error code (which is !IS_ERR_VALUE)
can result in a client oops. So fix it by adding a check and converting unknown
or invalid error codes to -ESERVERFAULT.

Signed-off-by: Abhishek Kulkarni <adkulkar@umail.iu.edu>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

diff --git a/net/9p/client.c b/net/9p/client.c
index 7bbd2d5ae8d3099915d8e215575c735743497d8c..5bf5f227dbe0d83eaf28cc400a665594c6452a22 100644 (file)
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -411,14 +411,9 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
                if (c->dotu)
                        err = -ecode;
 
-               if (!err) {
+               if (!err || !IS_ERR_VALUE(err))
                        err = p9_errstr2errno(ename, strlen(ename));
 
-                       /* string match failed */
-                       if (!err)
-                               err = -ESERVERFAULT;
-               }
-
                P9_DPRINTK(P9_DEBUG_9P, "<<< RERROR (%d) %s\n", -ecode, ename);
 
                kfree(ename);

diff --git a/net/9p/error.c b/net/9p/error.c
index fdebe4314062c01e02636d5201a2068ee57a640c..52518512a93e86eb261b34af3dddf6778a9ea50f 100644 (file)
--- a/net/9p/error.c
+++ b/net/9p/error.c
@@ -239,7 +239,7 @@ int p9_errstr2errno(char *errstr, int len)
                errstr[len] = 0;
                printk(KERN_ERR "%s: server reported unknown error %s\n",
                        __func__, errstr);
-               errno = 1;
+               errno = ESERVERFAULT;
        }
 
        return -errno;