Commit 209fd720 authored by Michal Luczaj's avatar Michal Luczaj Committed by Jakub Kicinski
Browse files

vsock: Fix transport_{g2h,h2g} TOCTOU 



vsock_find_cid() and vsock_dev_do_ioctl() may race with module unload.
transport_{g2h,h2g} may become NULL after the NULL check.

Introduce vsock_transport_local_cid() to protect from a potential
null-ptr-deref.

KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
RIP: 0010:vsock_find_cid+0x47/0x90
Call Trace:
 __vsock_bind+0x4b2/0x720
 vsock_bind+0x90/0xe0
 __sys_bind+0x14d/0x1e0
 __x64_sys_bind+0x6e/0xc0
 do_syscall_64+0x92/0x1c0
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
RIP: 0010:vsock_dev_do_ioctl.isra.0+0x58/0xf0
Call Trace:
 __x64_sys_ioctl+0x12d/0x190
 do_syscall_64+0x92/0x1c0
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Fixes: c0cfa2d8 ("vsock: add multi-transports support")
Suggested-by: default avatarStefano Garzarella <sgarzare@redhat.com>
Reviewed-by: default avatarStefano Garzarella <sgarzare@redhat.com>
Signed-off-by: default avatarMichal Luczaj <mhal@rbox.co>
Link: https://patch.msgid.link/20250703-vsock-transports-toctou-v4-1-98f0eb530747@rbox.co


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 95a234f6

net/vmw_vsock/af_vsock.c

+21 −6
Original line number Diff line number Diff line
@@ -531,9 +531,25 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) 
}

EXPORT_SYMBOL_GPL(vsock_assign_transport);



/*

 * Provide safe access to static transport_{h2g,g2h,dgram,local} callbacks.

 * Otherwise we may race with module removal. Do not use on `vsk->transport`.

 */

static u32 vsock_registered_transport_cid(const struct vsock_transport **transport)

{

	u32 cid = VMADDR_CID_ANY;



	mutex_lock(&vsock_register_mutex);

	if (*transport)

		cid = (*transport)->get_local_cid();

	mutex_unlock(&vsock_register_mutex);



	return cid;

}



bool vsock_find_cid(unsigned int cid)

{

	if (transport_g2h && cid == transport_g2h->get_local_cid())

	if (cid == vsock_registered_transport_cid(&transport_g2h))

		return true;



	if (transport_h2g && cid == VMADDR_CID_HOST)
@@ -2536,18 +2552,17 @@ static long vsock_dev_do_ioctl(struct file *filp, 
			       unsigned int cmd, void __user *ptr)

{

	u32 __user *p = ptr;

	u32 cid = VMADDR_CID_ANY;

	int retval = 0;

	u32 cid;



	switch (cmd) {

	case IOCTL_VM_SOCKETS_GET_LOCAL_CID:

		/* To be compatible with the VMCI behavior, we prioritize the

		 * guest CID instead of well-know host CID (VMADDR_CID_HOST).

		 */

		if (transport_g2h)

			cid = transport_g2h->get_local_cid();

		else if (transport_h2g)

			cid = transport_h2g->get_local_cid();

		cid = vsock_registered_transport_cid(&transport_g2h);

		if (cid == VMADDR_CID_ANY)

			cid = vsock_registered_transport_cid(&transport_h2g);



		if (put_user(cid, p) != 0)

			retval = -EFAULT;