Bug 88021

When a faulty server sends a directory/stat entry with the size field set to (u16) -2, or the last entry in a message has its size field set to a size larger then the actual size of the entry, the 9p driver goes into an infinite loop and all subsequent operations hang.

The reason for the inifite loop is in vfs_file.c:148. The function blindly trusts that the server sets the size field correctly, and calculates the length of the consumed record as st.size+2. This is then used in line 156 to increment the pointer to the start of the unread data (rdir->head).

If st.size is (u16) -2 however, this means that the consumed record length is calculated as 0, which means that rdir->head is not changed and the while loop (line 139) will never terminate as the condition rdir->head < rdir->tail is never reached. It will simply try to read the same record again and again.

If the last record in a message has a size field set to a value larger than the actual record, rdir->head will end up larger than rdir->tail. The inner while loop will terminate, starting a new iteration of the outer while loop (line 129: while(1)). The problem in this case is that rdir->head > rdir->tail, thus the conditional block starting on line 130 is not executed. The result is that no new data is read from the server, and rdir->head and rdir->tail are not updated. Hence the while loop at vfs_file.c:148 is attempted again, and skipped because rdir->head is still larger than rdir->tail, starting a new iteration of the outer loop with the same result.