Patch "vhost/vsock: always initialize seqpacket_allow" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    vhost/vsock: always initialize seqpacket_allow

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     vhost-vsock-always-initialize-seqpacket_allow.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a999784dcb8fb714861cf07be1daabd43d8fd8d9
Author: Michael S. Tsirkin <mst@xxxxxxxxxx>
Date:   Mon Apr 22 10:03:13 2024 -0400

    vhost/vsock: always initialize seqpacket_allow
    
    [ Upstream commit 1e1fdcbdde3b7663e5d8faeb2245b9b151417d22 ]
    
    There are two issues around seqpacket_allow:
    1. seqpacket_allow is not initialized when socket is
       created. Thus if features are never set, it will be
       read uninitialized.
    2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared,
       then seqpacket_allow will not be cleared appropriately
       (existing apps I know about don't usually do this but
        it's legal and there's no way to be sure no one relies
        on this).
    
    To fix:
            - initialize seqpacket_allow after allocation
            - set it unconditionally in set_features
    
    Reported-by: syzbot+6c21aeb59d0e82eb2782@xxxxxxxxxxxxxxxxxxxxxxxxx
    Reported-by: Jeongjun Park <aha310510@xxxxxxxxx>
    Fixes: ced7b713711f ("vhost/vsock: support SEQPACKET for transport").
    Tested-by: Arseny Krasnov <arseny.krasnov@xxxxxxxxxxxxx>
    Cc: David S. Miller <davem@xxxxxxxxxxxxx>
    Cc: Stefan Hajnoczi <stefanha@xxxxxxxxxx>
    Message-ID: <20240422100010-mutt-send-email-mst@xxxxxxxxxx>
    Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    Acked-by: Jason Wang <jasowang@xxxxxxxxxx>
    Reviewed-by: Stefano Garzarella <sgarzare@xxxxxxxxxx>
    Reviewed-by: Eugenio Pérez <eperezma@xxxxxxxxxx>
    Acked-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 74ac0c28fe43a..531e3e139c0d0 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -684,6 +684,7 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
 	}
 
 	vsock->guest_cid = 0; /* no CID assigned yet */
+	vsock->seqpacket_allow = false;
 
 	atomic_set(&vsock->queued_replies, 0);
 
@@ -842,8 +843,7 @@ static int vhost_vsock_set_features(struct vhost_vsock *vsock, u64 features)
 			goto err;
 	}
 
-	if (features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET))
-		vsock->seqpacket_allow = true;
+	vsock->seqpacket_allow = features & (1ULL << VIRTIO_VSOCK_F_SEQPACKET);
 
 	for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) {
 		vq = &vsock->vqs[i];