Commit ed0de9e6 authored Feb 05, 2025 by Stefano Garzarella Committed by Pu Lehui Feb 05, 2025

vsock/bpf: return early if transport is not assigned

stable inclusion
from stable-v6.6.74
commit 58e586c30d0b6f5dc0174a41026f2b0a48c9aab6
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJXEX
CVE: CVE-2025-21670

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=58e586c30d0b



--------------------------------

commit f6abafcd32f9cfc4b1a2f820ecea70773e26d423 upstream.

Some of the core functions can only be called if the transport
has been assigned.

As Michal reported, a socket might have the transport at NULL,
for example after a failed connect(), causing the following trace:

    BUG: kernel NULL pointer dereference, address: 00000000000000a0
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0
    Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
    CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+
    RIP: 0010:vsock_connectible_has_data+0x1f/0x40
    Call Trace:
     vsock_bpf_recvmsg+0xca/0x5e0
     sock_recvmsg+0xb9/0xc0
     __sys_recvfrom+0xb3/0x130
     __x64_sys_recvfrom+0x20/0x30
     do_syscall_64+0x93/0x180
     entry_SYSCALL_64_after_hwframe+0x76/0x7e

So we need to check the `vsk->transport` in vsock_bpf_recvmsg(),
especially for connected sockets (stream/seqpacket) as we already
do in __vsock_connectible_recvmsg().

Fixes: 634f1a71 ("vsock: support sockmap")
Cc: stable@vger.kernel.org
Reported-by: Michal Luczaj <mhal@rbox.co>
Closes: https://lore.kernel.org/netdev/5ca20d4c-1017-49c2-9516-f6f75fd331e9@rbox.co/


Tested-by: Michal Luczaj <mhal@rbox.co>
Reported-by:  <syzbot+3affdbfc986ecd9200fd@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/netdev/677f84a8.050a0220.25a300.01b3.GAE@google.com/


Tested-by:  <syzbot+3affdbfc986ecd9200fd@syzkaller.appspotmail.com>
Reviewed-by: Hyunwoo Kim <v4bel@theori.io>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Pu Lehui <pulehui@huawei.com>

parent 5f597f38

net/vmw_vsock/vsock_bpf.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -77,6 +77,7 @@ static int vsock_bpf_recvmsg(struct sock sk, struct msghdr msg,
		size_t len, int flags, int *addr_len)
		{
		struct sk_psock *psock;
		struct vsock_sock *vsk;
		int copied;

		psock = sk_psock_get(sk);
		@@ -84,6 +85,13 @@ static int vsock_bpf_recvmsg(struct sock sk, struct msghdr msg,
		return __vsock_recvmsg(sk, msg, len, flags);

		lock_sock(sk);
		vsk = vsock_sk(sk);

		if (!vsk->transport) {
		copied = -ENODEV;
		goto out;
		}

		if (vsock_has_data(sk, psock) && sk_psock_queue_empty(psock)) {
		release_sock(sk);
		sk_psock_put(sk, psock);
		@@ -108,6 +116,7 @@ static int vsock_bpf_recvmsg(struct sock sk, struct msghdr msg,
		copied = sk_msg_recvmsg(sk, psock, msg, len, flags);
		}

		out:
		release_sock(sk);
		sk_psock_put(sk, psock);