From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A126217F48 for ; Fri, 10 Jan 2025 22:52:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736549536; cv=none; b=b5t3pFncZ2COxljdDcrl+PfuexUrlgTuzi9cjstU7MLkq5OS3JRHRz0BORUUnLTjWviB+mypjo4GpE/hyj5d4qcCgDYRJEdj6DpepHP/yz9muNElDzCQc16LA0UFqW6oG4ymIr0nmmYfrV5TXHsvglgppPv7V50VjBBZCnHw0TY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736549536; c=relaxed/simple; bh=JZHqlk+65oHwniuof9YMax5W0VcsEzP6KM6gcWIovm8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=HQnP3/ZdB2KtR4gTHfr5d+gI6cE75bHfXYx6m2d3+vkDhtT3TLGx9WX6aXGjxLiBvToPKUxtbm1ITu5+7weCLipW6lZiniqMT26py6rYvD+CZ4UGQsk3Uj4abp0WfQx5fL7wD9lOyIdtZQXt31yo92+MhFE6qSL0LVqAoI780Y8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=theori.io; spf=pass smtp.mailfrom=theori.io; dkim=pass (1024-bit key) header.d=theori.io header.i=@theori.io header.b=BKw1uIFh; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=theori.io Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=theori.io Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=theori.io header.i=@theori.io header.b="BKw1uIFh" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2163b0c09afso45919795ad.0 for ; Fri, 10 Jan 2025 14:52:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=theori.io; s=google; t=1736549534; x=1737154334; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=Vbi6CHxANPrMQarVV/c3DpvaHRVNCAuF1gxqd1Fssgk=; b=BKw1uIFhlO+laccxuFETQVE/E3WqKt1hqIZ2kJSRWbXFbcKOuCoPJfGJhTWIrKSnOz tiQWY7z01efC6pZCDZmsuRGF4UU5jjoY3s+o2c+5U+vfz9wPc/x38IminR0gDZvWZbyj 2oJM/e8v/VFARqsE6CRPna4tfWrh5wzaPb1eA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736549534; x=1737154334; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Vbi6CHxANPrMQarVV/c3DpvaHRVNCAuF1gxqd1Fssgk=; b=TfM01heVDb7ZWptOwE26S0hK964IqWdsla76hrebucJqv6Kf2j74QVywm3FsuNtqKH aeOA2bIV/nFj8XOYQC1gtZbC5iO2tqcv6ykmQsjk1mlUIDkwvqPupVY3rV/tEhbGlelB AMypSrrKo5zqF7Rq572Tsj6pmwXGqycJ/PzuLJtOV3ANfo6GKCYuQ3RElCGziRAfQT8Q EWkfWSDCw4nmssqTGkYp7RD+OMmaojOlyCQsaMadt84xKfLypb41zQsez6Pr4C2CWkLQ QNQFHNjTZPZt9vSuLzZz9DHF0VJOexGbIqncH+BF5qdmus/vz98euiOJIboLPsRcVvk9 YRMQ== X-Forwarded-Encrypted: i=1; AJvYcCWtgtINLGkBzv3Hzqk2M+XEdc12G4G7nnjgsOG/L3n4aN97vMyJF8uUB01ncdVusPtqJ+h3suZVk94Z9So=@vger.kernel.org X-Gm-Message-State: AOJu0YzRp4gbFPCHCnHaPQ8ZE6PaNUMEoJlcJjcs824skl0bzQzL/qxR qSQhmUM2p9/BUMGXqrahFyRMAeH8AQBSX14UVnf+W+yQDSfouABGsZRhAuBxD7g= X-Gm-Gg: ASbGncu75gfzHHVEIMYuMd0mMI5Kndjg96f5qcY8SNplgJ5ywcNr3/TLo++26BO832E jh3gW86E1UuT0D7tsMKal3Kvbun/TisjMa+EIyWrfndK7xdgK89iSGnw7UvGTSKo+g0aM0OIE/k +zCQXr9joMdZfhEMLwGFSDonPw09b/QmaQxZhRobqXTEhjCJFMfmn1cfjYNX6wkemvzuv0ZEMmJ I5AHuqNGw6WgimEfKQrUoYGkCImNaWnNNHuvzeHNRFSCOkRVu2O+T5fPEN7LNtFz9ny0Q== X-Google-Smtp-Source: AGHT+IENF/FxDNTliDs2DD6iZam46B2U64YorZ5+dfuiE11gQj49C7rnn2z29pL0pKaqTcMm+AS1GA== X-Received: by 2002:a17:902:e84c:b0:215:4757:9ef3 with SMTP id d9443c01a7336-21a83f338b0mr168094885ad.9.1736549533645; Fri, 10 Jan 2025 14:52:13 -0800 (PST) Received: from v4bel-B760M-AORUS-ELITE-AX ([211.219.71.65]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-21a9f10f4f3sm17847985ad.31.2025.01.10.14.52.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jan 2025 14:52:13 -0800 (PST) Date: Fri, 10 Jan 2025 17:52:06 -0500 From: Hyunwoo Kim To: Stefano Garzarella Cc: netdev@vger.kernel.org, Xuan Zhuo , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, Luigi Leonardi , "David S. Miller" , Wongi Lee , Eugenio =?iso-8859-1?Q?P=E9rez?= , "Michael S. Tsirkin" , Eric Dumazet , kvm@vger.kernel.org, Paolo Abeni , Stefan Hajnoczi , Jason Wang , Simon Horman , Jakub Kicinski , Michal Luczaj , virtualization@lists.linux.dev, Bobby Eshleman , stable@vger.kernel.org, imv4bel@gmail.com, v4bel@theori.io Subject: Re: [PATCH net v2 5/5] vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Message-ID: References: <20250110083511.30419-1-sgarzare@redhat.com> <20250110083511.30419-6-sgarzare@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20250110083511.30419-6-sgarzare@redhat.com> On Fri, Jan 10, 2025 at 09:35:11AM +0100, Stefano Garzarella wrote: > Recent reports have shown how we sometimes call vsock_*_has_data() > when a vsock socket has been de-assigned from a transport (see attached > links), but we shouldn't. > > Previous commits should have solved the real problems, but we may have > more in the future, so to avoid null-ptr-deref, we can return 0 > (no space, no data available) but with a warning. > > This way the code should continue to run in a nearly consistent state > and have a warning that allows us to debug future problems. > > Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") > Cc: stable@vger.kernel.org > Link: https://lore.kernel.org/netdev/Z2K%2FI4nlHdfMRTZC@v4bel-B760M-AORUS-ELITE-AX/ > Link: https://lore.kernel.org/netdev/5ca20d4c-1017-49c2-9516-f6f75fd331e9@rbox.co/ > Link: https://lore.kernel.org/netdev/677f84a8.050a0220.25a300.01b3.GAE@google.com/ > Co-developed-by: Hyunwoo Kim > Signed-off-by: Hyunwoo Kim > Co-developed-by: Wongi Lee > Signed-off-by: Wongi Lee > Signed-off-by: Stefano Garzarella > --- > net/vmw_vsock/af_vsock.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c > index 74d35a871644..fa9d1b49599b 100644 > --- a/net/vmw_vsock/af_vsock.c > +++ b/net/vmw_vsock/af_vsock.c > @@ -879,6 +879,9 @@ EXPORT_SYMBOL_GPL(vsock_create_connected); > > s64 vsock_stream_has_data(struct vsock_sock *vsk) > { > + if (WARN_ON(!vsk->transport)) > + return 0; > + > return vsk->transport->stream_has_data(vsk); > } > EXPORT_SYMBOL_GPL(vsock_stream_has_data); > @@ -887,6 +890,9 @@ s64 vsock_connectible_has_data(struct vsock_sock *vsk) > { > struct sock *sk = sk_vsock(vsk); > > + if (WARN_ON(!vsk->transport)) > + return 0; > + > if (sk->sk_type == SOCK_SEQPACKET) > return vsk->transport->seqpacket_has_data(vsk); > else > @@ -896,6 +902,9 @@ EXPORT_SYMBOL_GPL(vsock_connectible_has_data); > > s64 vsock_stream_has_space(struct vsock_sock *vsk) > { > + if (WARN_ON(!vsk->transport)) > + return 0; > + > return vsk->transport->stream_has_space(vsk); > } > EXPORT_SYMBOL_GPL(vsock_stream_has_space); > -- > 2.47.1 > Reviewed-by: Hyunwoo Kim Regards, Hyunwoo Kim