Skip to content

Commit bc9c493

Browse files
stefano-garzarellagregkh
authored andcommitted
vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
commit 91751e2 upstream. Recent reports have shown how we sometimes call vsock_*_has_data() when a vsock socket has been de-assigned from a transport (see attached links), but we shouldn't. Previous commits should have solved the real problems, but we may have more in the future, so to avoid null-ptr-deref, we can return 0 (no space, no data available) but with a warning. This way the code should continue to run in a nearly consistent state and have a warning that allows us to debug future problems. Fixes: c0cfa2d ("vsock: add multi-transports support") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/netdev/Z2K%2FI4nlHdfMRTZC@v4bel-B760M-AORUS-ELITE-AX/ Link: https://lore.kernel.org/netdev/5ca20d4c-1017-49c2-9516-f6f75fd331e9@rbox.co/ Link: https://lore.kernel.org/netdev/677f84a8.050a0220.25a300.01b3.GAE@google.com/ Co-developed-by: Hyunwoo Kim <v4bel@theori.io> Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Co-developed-by: Wongi Lee <qwerty@theori.io> Signed-off-by: Wongi Lee <qwerty@theori.io> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: Luigi Leonardi <leonardi@redhat.com> Reviewed-by: Hyunwoo Kim <v4bel@theori.io> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 8a15c81 commit bc9c493

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

net/vmw_vsock/af_vsock.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -875,6 +875,9 @@ EXPORT_SYMBOL_GPL(vsock_create_connected);
875875

876876
s64 vsock_stream_has_data(struct vsock_sock *vsk)
877877
{
878+
if (WARN_ON(!vsk->transport))
879+
return 0;
880+
878881
return vsk->transport->stream_has_data(vsk);
879882
}
880883
EXPORT_SYMBOL_GPL(vsock_stream_has_data);
@@ -883,6 +886,9 @@ s64 vsock_connectible_has_data(struct vsock_sock *vsk)
883886
{
884887
struct sock *sk = sk_vsock(vsk);
885888

889+
if (WARN_ON(!vsk->transport))
890+
return 0;
891+
886892
if (sk->sk_type == SOCK_SEQPACKET)
887893
return vsk->transport->seqpacket_has_data(vsk);
888894
else
@@ -892,6 +898,9 @@ EXPORT_SYMBOL_GPL(vsock_connectible_has_data);
892898

893899
s64 vsock_stream_has_space(struct vsock_sock *vsk)
894900
{
901+
if (WARN_ON(!vsk->transport))
902+
return 0;
903+
895904
return vsk->transport->stream_has_space(vsk);
896905
}
897906
EXPORT_SYMBOL_GPL(vsock_stream_has_space);

0 commit comments

Comments
 (0)