On Wed, May 15, 2024 at 11:05:43AM GMT, Michael S. Tsirkin wrote:
There are two issues around seqpacket_allow:
1. seqpacket_allow is not initialized when socket is
created. Thus if features are never set, it will be
read uninitialized.
2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared,
then seqpacket_allow will not be cleared appropriately
(existing apps I know about don't usually do this but
it's legal and there's no way to be sure no one relies
on this).
To fix:
- initialize seqpacket_allow after allocation
- set it unconditionally in set_features
Reported-by: syzbot+6c21aeb59d0e82eb2782@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: Jeongjun Park <aha310510@xxxxxxxxx>
Fixes: ced7b713711f ("vhost/vsock: support SEQPACKET for transport").
Cc: Arseny Krasnov <arseny.krasnov@xxxxxxxxxxxxx>
Cc: David S. Miller <davem@xxxxxxxxxxxxx>
Cc: Stefan Hajnoczi <stefanha@xxxxxxxxxx>
Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
Acked-by: Arseniy Krasnov <avkrasnov@xxxxxxxxxxxxxxxxx>
Tested-by: Arseniy Krasnov <avkrasnov@xxxxxxxxxxxxxxxxx>
---
Reposting now it's been tested.
drivers/vhost/vsock.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
Thanks for fixing this issue!
Reviewed-by: Stefano Garzarella <sgarzare@xxxxxxxxxx>
