tree dfae14dc82a4032ca0d34f49c0faf35633c6863e
parent 9f0933ac026f7e54fe096797af9de20724e79097
parent 391c18cf776eb4569ecda1f7794f360fe0a45a26
author Linus Torvalds <torvalds@linux-foundation.org> 1669230369 -0800
committer Linus Torvalds <torvalds@linux-foundation.org> 1669230369 -0800
mergetag object 391c18cf776eb4569ecda1f7794f360fe0a45a26
 type commit
 tag 9p-for-6.1-rc7
 tagger Dominique Martinet <asmadeus@codewreck.org> 1669180222 +0900
 
 9p-for-6.1-rc7
 
 Two fixes:
  - 9p now uses a variable size for its recv buffer, but every place
 hadn't been updated properly to use it and some buffer overflows
 have been found and needed fixing.
 There's still one place where msize is incorrectly used in a safety
 check (p9_check_errors), but all paths leading to it should already
 be avoiding overflows and that patch took a bit more time to get
 right for zero-copy requests so I'll send it for 6.2
  - yet another race condition in p9_conn_cancel introduced by a
 fix of a syzbot report in the same place, maybe at some point
 we'll get it right without burning it all down...
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE/IPbcYBuWt0zoYhOq06b7GqY5nAFAmN9q0QACgkQq06b7GqY
 5nAYfhAAkV4BuDAxkq1J9m2tAr32bNgSWRbwHGoiO3yOgN3OQcl0MRR910VLPaBe
 rRMbggIZKp6SjKpL5CQUbIcf+ubvcHZQpglCWdJT6Cch9VAidwKB4y48V0nb9Gos
 Z2lAtKCdlczmmbYY+KQ4KrFXKXkHXV7FPH7aLLaVg6VxckbRwunDMAPIQJ2wtUDq
 GP+J0OBL6NGb1N1TrAx9uQMzM9Zbu/pfQ8Ik/PdwzcT5fWm6OOlICOe/ImAlFfiN
 AU0+jc1c01DhQiGedEytOLWMlvcUtgbN2VoMszAuIdn3MFdRFiklQ/5IYFvEu4z4
 vWeSL5ctsrgqhG0i5gNTDspzmX05amBaN7UOyQ8yvCYs9Jgv7x9EghdXA4XMX3UD
 l8QcNQgthTVtI2waspAmWOV4anPjr4VJIcoLKapzAXTpd7SCJazzap/0CvXjTINK
 IX4Fjeg9eKeQPsHgeLiO00zokM0LPZ+W4X6Xus1rrwzHVtde78bqokrUV/U6wVKF
 UT0i06oEYlB79ySOmgqoZuFRbos7VZI6l6hLkbo+XJOPalWzP5MwexGS2JVo4ymS
 Xu5DYlqnSdQQxScHdK906Ksbusa3n5jxAURqOIQxJ1UZyC7CPusVy2KA4FiZsL/x
 OkYGlSg60tvsOfaNQoXOlziG2u3FJrZFjsurvgBgsgtUWEgVaU0=
 =MQOZ
 -----END PGP SIGNATURE-----

Merge tag '9p-for-6.1-rc7' of https://github.com/martinetd/linux

Pull 9p fixes from Dominique Martinet:

 - 9p now uses a variable size for its recv buffer, but every place
   hadn't been updated properly to use it and some buffer overflows have
   been found and needed fixing.

   There's still one place where msize is incorrectly used in a safety
   check (p9_check_errors), but all paths leading to it should already
   be avoiding overflows and that patch took a bit more time to get
   right for zero-copy requests so I'll send it for 6.2

 - yet another race condition in p9_conn_cancel introduced by a fix for
   a syzbot report in the same place. Maybe at some point we'll get it
   right without burning it all down...

* tag '9p-for-6.1-rc7' of https://github.com/martinetd/linux:
  9p/xen: check logical size for buffer size
  9p/fd: Use P9_HDRSZ for header size
  9p/fd: Fix write overflow in p9_read_work
  9p/fd: fix issue of list_del corruption in p9_fd_cancel()