[PATCH] 9p: reject RERROR/RLERROR with zero errcode

[Dominique Martinet]

From: Hui Peng <benquike@xxxxxxxxx>

In p9_check_errors() (net/9p/client.c), a malicious or buggy 9p server
returning P9_RERROR or P9_RLERROR with ecode == 0 causes
p9_check_errors() to return 0 (success) while leaving the unparsed
response payload as if the expected reply message type succeeded.

Map ecode == 0 on RERROR / RLERROR to -EPROTO.

Link: https://lore.kernel.org/all/20260919221734.3708000-1-benquike@xxxxxxxxx/
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
This is a resend of the other half of that commit, since the original
author never bothered to do it.
It's valid enough to be worth the 5 minutes to resend it...

I kept their commit message & code verbatim so kept them author

 net/9p/client.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/9p/client.c b/net/9p/client.c
index ef64546c6d52..e63e8c2a853d 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -448,6 +448,9 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
 		p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode);
 	}
 
+	if (!err)
+		err = -EPROTO;
+
 	return err;
 
 out_err:
-- 
2.56.0