linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>,
	Graham Whaley <graham.whaley@gmail.com>,
	"Michael S . Tsirkin" <mst@redhat.com>,
	Sasha Levin <sashal@kernel.org>,
	kvm@vger.kernel.org, virtualization@lists.linux-foundation.org,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 30/34] vhost/vsock: fix reset orphans race with close timeout
Date: Wed, 12 Dec 2018 23:31:56 -0500	[thread overview]
Message-ID: <20181213043200.76295-30-sashal@kernel.org> (raw)
In-Reply-To: <20181213043200.76295-1-sashal@kernel.org>

From: Stefan Hajnoczi <stefanha@redhat.com>

[ Upstream commit c38f57da428b033f2721b611d84b1f40bde674a8 ]

If a local process has closed a connected socket and hasn't received a
RST packet yet, then the socket remains in the table until a timeout
expires.

When a vhost_vsock instance is released with the timeout still pending,
the socket is never freed because vhost_vsock has already set the
SOCK_DONE flag.

Check if the close timer is pending and let it close the socket.  This
prevents the race which can leak sockets.

Reported-by: Maximilian Riemensberger <riemensberger@cadami.net>
Cc: Graham Whaley <graham.whaley@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vhost/vsock.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 0ec970ca64ce..5d77a7491edb 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -551,13 +551,21 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
 	 * executing.
 	 */
 
-	if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) {
-		sock_set_flag(sk, SOCK_DONE);
-		vsk->peer_shutdown = SHUTDOWN_MASK;
-		sk->sk_state = SS_UNCONNECTED;
-		sk->sk_err = ECONNRESET;
-		sk->sk_error_report(sk);
-	}
+	/* If the peer is still valid, no need to reset connection */
+	if (vhost_vsock_get(vsk->remote_addr.svm_cid))
+		return;
+
+	/* If the close timeout is pending, let it expire.  This avoids races
+	 * with the timeout callback.
+	 */
+	if (vsk->close_work_scheduled)
+		return;
+
+	sock_set_flag(sk, SOCK_DONE);
+	vsk->peer_shutdown = SHUTDOWN_MASK;
+	sk->sk_state = SS_UNCONNECTED;
+	sk->sk_err = ECONNRESET;
+	sk->sk_error_report(sk);
 }
 
 static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
-- 
2.19.1


  parent reply	other threads:[~2018-12-13  4:38 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-12-13  4:31 [PATCH AUTOSEL 4.9 01/34] mac80211_hwsim: fix module init error paths for netlink Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 02/34] scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 03/34] scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 04/34] x86/earlyprintk/efi: Fix infinite loop on some screen widths Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 05/34] drm/msm: Grab a vblank reference when waiting for commit_done Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 06/34] ARC: io.h: Implement reads{x}()/writes{x}() Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 07/34] bonding: fix 802.3ad state sent to partner when unbinding slave Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 08/34] nfs: don't dirty kernel pages read by direct-io Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 09/34] SUNRPC: Fix leak of krb5p encode pages Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 10/34] SUNRPC: Fix a potential race in xprt_connect() Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 11/34] sbus: char: add of_node_put() Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 12/34] drivers/sbus/char: " Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 13/34] drivers/tty: add missing of_node_put() Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 14/34] ide: pmac: add of_node_put() Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 15/34] clk: mvebu: Off by one bugs in cp110_of_clk_get() Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 16/34] clk: mmp: Off by one in mmp_clk_add() Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 17/34] Input: omap-keypad - fix keyboard debounce configuration Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 18/34] libata: whitelist all SAMSUNG MZ7KM* solid-state disks Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 19/34] net: phy: don't allow __set_phy_supported to add unsupported modes Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 20/34] net: 8139cp: fix a BUG triggered by changing mtu with network traffic Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 21/34] net: phy: Fix not to call phy_resume() if PHY is not attached Sasha Levin
2018-12-13  4:50   ` Yoshihiro Shimoda
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 22/34] mv88e6060: disable hardware level MAC learning Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 23/34] net/mlx4_en: Fix build break when CONFIG_INET is off Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 24/34] bpf: check pending signals while verifying programs Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 25/34] ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 26/34] ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 27/34] ethernet: fman: fix wrong of_node_put() in probe function Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 28/34] drm/ast: Fix connector leak during driver unload Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 29/34] cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs) Sasha Levin
2018-12-13  4:31 ` Sasha Levin [this message]
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 31/34] i2c: axxia: properly handle master timeout Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 32/34] i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node Sasha Levin
2018-12-13  4:31 ` [PATCH AUTOSEL 4.9 33/34] nvmet-rdma: fix response use after free Sasha Levin
2018-12-13  4:32 ` [PATCH AUTOSEL 4.9 34/34] net/mlx4_core: Correctly set PFC param if global pause is turned off Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181213043200.76295-30-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=graham.whaley@gmail.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mst@redhat.com \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=stefanha@redhat.com \
    --cc=virtualization@lists.linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).