On Fri, Jan 10, 2025 at 09:35:11AM +0100, Stefano Garzarella wrote:
> Recent reports have shown how we sometimes call vsock_*_has_data()
> when a vsock socket has been de-assigned from a transport (see attached
> links), but we shouldn't.
>
> Previous commits should have solved the real problems, but we may have
> more in the future, so to avoid null-ptr-deref, we can return 0
> (no space, no data available) but with a warning.
>
> This way the code should continue to run in a nearly consistent state
> and have a warning that allows us to debug future problems.
>
> Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
> Cc: stable@xxxxxxxxxxxxxxx
> Link: https://lore.kernel.org/netdev/Z2K%2FI4nlHdfMRTZC@v4bel-B760M-AORUS-ELITE-AX/
> Link: https://lore.kernel.org/netdev/5ca20d4c-1017-49c2-9516-f6f75fd331e9@xxxxxxx/
> Link: https://lore.kernel.org/netdev/677f84a8.050a0220.25a300.01b3.GAE@xxxxxxxxxx/
> Co-developed-by: Hyunwoo Kim <v4bel@xxxxxxxxx>
> Signed-off-by: Hyunwoo Kim <v4bel@xxxxxxxxx>
> Co-developed-by: Wongi Lee <qwerty@xxxxxxxxx>
> Signed-off-by: Wongi Lee <qwerty@xxxxxxxxx>
> Signed-off-by: Stefano Garzarella <sgarzare@xxxxxxxxxx>
> ---
> net/vmw_vsock/af_vsock.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
> index 74d35a871644..fa9d1b49599b 100644
> --- a/net/vmw_vsock/af_vsock.c
> +++ b/net/vmw_vsock/af_vsock.c
> @@ -879,6 +879,9 @@ EXPORT_SYMBOL_GPL(vsock_create_connected);
>
> s64 vsock_stream_has_data(struct vsock_sock *vsk)
> {
> + if (WARN_ON(!vsk->transport))
> + return 0;
> +
> return vsk->transport->stream_has_data(vsk);
> }
> EXPORT_SYMBOL_GPL(vsock_stream_has_data);
> @@ -887,6 +890,9 @@ s64 vsock_connectible_has_data(struct vsock_sock *vsk)
> {
> struct sock *sk = sk_vsock(vsk);
>
> + if (WARN_ON(!vsk->transport))
> + return 0;
> +
> if (sk->sk_type == SOCK_SEQPACKET)
> return vsk->transport->seqpacket_has_data(vsk);
> else
> @@ -896,6 +902,9 @@ EXPORT_SYMBOL_GPL(vsock_connectible_has_data);
>
> s64 vsock_stream_has_space(struct vsock_sock *vsk)
> {
> + if (WARN_ON(!vsk->transport))
> + return 0;
> +
> return vsk->transport->stream_has_space(vsk);
> }
> EXPORT_SYMBOL_GPL(vsock_stream_has_space);
> --
> 2.47.1
>
Reviewed-by: Hyunwoo Kim <v4bel@xxxxxxxxx>
Regards,
Hyunwoo Kim
