Michael S. Tsirkin ea558f10fb vhost/vsock: always initialize seqpacket_allow ...

[ Upstream commit 1e1fdcbdde ]

There are two issues around seqpacket_allow:
1. seqpacket_allow is not initialized when socket is
   created. Thus if features are never set, it will be
   read uninitialized.
2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared,
   then seqpacket_allow will not be cleared appropriately
   (existing apps I know about don't usually do this but
    it's legal and there's no way to be sure no one relies
    on this).

To fix:
	- initialize seqpacket_allow after allocation
	- set it unconditionally in set_features

Reported-by: syzbot+6c21aeb59d0e82eb2782@syzkaller.appspotmail.com
Reported-by: Jeongjun Park <aha310510@gmail.com>
Fixes: ced7b71371 ("vhost/vsock: support SEQPACKET for transport").
Tested-by: Arseny Krasnov <arseny.krasnov@kaspersky.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20240422100010-mutt-send-email-mst@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-08-19 05:45:06 +02:00

..

iotlb.c

…

Kconfig

…

Makefile

…

net.c

…

scsi.c

…

test.c

…

test.h

…

vdpa.c

…

vhost.c

vhost: Add smp_rmb() in vhost_vq_avail_empty()

2024-04-17 11:15:16 +02:00

vhost.h

…

vringh.c

vringh: don't use vringh_kiov_advance() in vringh_iov_xfer()

2023-10-10 21:59:05 +02:00

vsock.c

vhost/vsock: always initialize seqpacket_allow

2024-08-19 05:45:06 +02:00