Skip to content

Commit 91751e2

Browse files
stefano-garzarellaPaolo Abeni
authored andcommitted
vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
Recent reports have shown how we sometimes call vsock_*_has_data() when a vsock socket has been de-assigned from a transport (see attached links), but we shouldn't. Previous commits should have solved the real problems, but we may have more in the future, so to avoid null-ptr-deref, we can return 0 (no space, no data available) but with a warning. This way the code should continue to run in a nearly consistent state and have a warning that allows us to debug future problems. Fixes: c0cfa2d ("vsock: add multi-transports support") Cc: [email protected] Link: https://lore.kernel.org/netdev/Z2K%2FI4nlHdfMRTZC@v4bel-B760M-AORUS-ELITE-AX/ Link: https://lore.kernel.org/netdev/[email protected]/ Link: https://lore.kernel.org/netdev/[email protected]/ Co-developed-by: Hyunwoo Kim <[email protected]> Signed-off-by: Hyunwoo Kim <[email protected]> Co-developed-by: Wongi Lee <[email protected]> Signed-off-by: Wongi Lee <[email protected]> Signed-off-by: Stefano Garzarella <[email protected]> Reviewed-by: Luigi Leonardi <[email protected]> Reviewed-by: Hyunwoo Kim <[email protected]> Signed-off-by: Paolo Abeni <[email protected]>
1 parent a24009b commit 91751e2

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

net/vmw_vsock/af_vsock.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -879,6 +879,9 @@ EXPORT_SYMBOL_GPL(vsock_create_connected);
879879

880880
s64 vsock_stream_has_data(struct vsock_sock *vsk)
881881
{
882+
if (WARN_ON(!vsk->transport))
883+
return 0;
884+
882885
return vsk->transport->stream_has_data(vsk);
883886
}
884887
EXPORT_SYMBOL_GPL(vsock_stream_has_data);
@@ -887,6 +890,9 @@ s64 vsock_connectible_has_data(struct vsock_sock *vsk)
887890
{
888891
struct sock *sk = sk_vsock(vsk);
889892

893+
if (WARN_ON(!vsk->transport))
894+
return 0;
895+
890896
if (sk->sk_type == SOCK_SEQPACKET)
891897
return vsk->transport->seqpacket_has_data(vsk);
892898
else
@@ -896,6 +902,9 @@ EXPORT_SYMBOL_GPL(vsock_connectible_has_data);
896902

897903
s64 vsock_stream_has_space(struct vsock_sock *vsk)
898904
{
905+
if (WARN_ON(!vsk->transport))
906+
return 0;
907+
899908
return vsk->transport->stream_has_space(vsk);
900909
}
901910
EXPORT_SYMBOL_GPL(vsock_stream_has_space);

0 commit comments

Comments
 (0)