Patch "sockmap, vsock: For connectible sockets allow only connected" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    sockmap, vsock: For connectible sockets allow only connected

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     sockmap-vsock-for-connectible-sockets-allow-only-con.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d453859cb951dd6f29208d7d5cb91ef415cb67ef
Author: Michal Luczaj <mhal@xxxxxxx>
Date:   Thu Feb 13 12:58:49 2025 +0100

    sockmap, vsock: For connectible sockets allow only connected
    
    [ Upstream commit 8fb5bb169d17cdd12c2dcc2e96830ed487d77a0f ]
    
    sockmap expects all vsocks to have a transport assigned, which is expressed
    in vsock_proto::psock_update_sk_prot(). However, there is an edge case
    where an unconnected (connectible) socket may lose its previously assigned
    transport. This is handled with a NULL check in the vsock/BPF recv path.
    
    Another design detail is that listening vsocks are not supposed to have any
    transport assigned at all. Which implies they are not supported by the
    sockmap. But this is complicated by the fact that a socket, before
    switching to TCP_LISTEN, may have had some transport assigned during a
    failed connect() attempt. Hence, we may end up with a listening vsock in a
    sockmap, which blows up quickly:
    
    KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127]
    CPU: 7 UID: 0 PID: 56 Comm: kworker/7:0 Not tainted 6.14.0-rc1+
    Workqueue: vsock-loopback vsock_loopback_work
    RIP: 0010:vsock_read_skb+0x4b/0x90
    Call Trace:
     sk_psock_verdict_data_ready+0xa4/0x2e0
     virtio_transport_recv_pkt+0x1ca8/0x2acc
     vsock_loopback_work+0x27d/0x3f0
     process_one_work+0x846/0x1420
     worker_thread+0x5b3/0xf80
     kthread+0x35a/0x700
     ret_from_fork+0x2d/0x70
     ret_from_fork_asm+0x1a/0x30
    
    For connectible sockets, instead of relying solely on the state of
    vsk->transport, tell sockmap to only allow those representing established
    connections. This aligns with the behaviour for AF_INET and AF_UNIX.
    
    Fixes: 634f1a7110b4 ("vsock: support sockmap")
    Signed-off-by: Michal Luczaj <mhal@xxxxxxx>
    Acked-by: Stefano Garzarella <sgarzare@xxxxxxxxxx>
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index f1b9b3958792c..2f1be9baad057 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -541,6 +541,9 @@ static bool sock_map_sk_state_allowed(const struct sock *sk)
 		return (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_LISTEN);
 	if (sk_is_stream_unix(sk))
 		return (1 << sk->sk_state) & TCPF_ESTABLISHED;
+	if (sk_is_vsock(sk) &&
+	    (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET))
+		return (1 << sk->sk_state) & TCPF_ESTABLISHED;
 	return true;
 }