* [PATCH] net/vmw_vsock: fix NULL pointer dereference
@ 2021-02-05 14:25 Norbert Slusarek
2021-02-05 17:13 ` Stefano Garzarella
0 siblings, 1 reply; 4+ messages in thread
From: Norbert Slusarek @ 2021-02-05 14:25 UTC (permalink / raw)
To: sgarzare, alex.popov, eric.dumazet; +Cc: netdev
From: Norbert Slusarek <nslusarek@gmx.net>
Date: Fri, 5 Feb 2021 13:12:06 +0100
Subject: [PATCH] net/vmw_vsock: fix NULL pointer dereference
In vsock_stream_connect(), a thread will enter schedule_timeout().
While being scheduled out, another thread can enter vsock_stream_connect()
as well and set vsk->transport to NULL. In case a signal was sent, the
first thread can leave schedule_timeout() and vsock_transport_cancel_pkt()
will be called right after. Inside vsock_transport_cancel_pkt(), a null
dereference will happen on transport->cancel_pkt.
Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
Reported-by: Norbert Slusarek <nslusarek@gmx.net>
Signed-off-by: Norbert Slusarek <nslusarek@gmx.net>
---
net/vmw_vsock/af_vsock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 6894f21dc147..cb81cfb47a78 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1233,7 +1233,7 @@ static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
{
const struct vsock_transport *transport = vsk->transport;
- if (!transport->cancel_pkt)
+ if (!transport || !transport->cancel_pkt)
return -EOPNOTSUPP;
return transport->cancel_pkt(vsk);
--
2.30.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] net/vmw_vsock: fix NULL pointer dereference
2021-02-05 14:25 [PATCH] net/vmw_vsock: fix NULL pointer dereference Norbert Slusarek
@ 2021-02-05 17:13 ` Stefano Garzarella
2021-02-07 0:57 ` Jakub Kicinski
0 siblings, 1 reply; 4+ messages in thread
From: Stefano Garzarella @ 2021-02-05 17:13 UTC (permalink / raw)
To: Norbert Slusarek
Cc: alex.popov, eric.dumazet, netdev, David S. Miller, Jakub Kicinski
On Fri, Feb 05, 2021 at 03:25:17PM +0100, Norbert Slusarek wrote:
>From: Norbert Slusarek <nslusarek@gmx.net>
>Date: Fri, 5 Feb 2021 13:12:06 +0100
>Subject: [PATCH] net/vmw_vsock: fix NULL pointer dereference
>
>In vsock_stream_connect(), a thread will enter schedule_timeout().
>While being scheduled out, another thread can enter vsock_stream_connect()
>as well and set vsk->transport to NULL. In case a signal was sent, the
>first thread can leave schedule_timeout() and vsock_transport_cancel_pkt()
>will be called right after. Inside vsock_transport_cancel_pkt(), a null
>dereference will happen on transport->cancel_pkt.
>
>Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
>Reported-by: Norbert Slusarek <nslusarek@gmx.net>
>Signed-off-by: Norbert Slusarek <nslusarek@gmx.net>
>---
> net/vmw_vsock/af_vsock.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
>index 6894f21dc147..cb81cfb47a78 100644
>--- a/net/vmw_vsock/af_vsock.c
>+++ b/net/vmw_vsock/af_vsock.c
>@@ -1233,7 +1233,7 @@ static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
> {
> const struct vsock_transport *transport = vsk->transport;
>
>- if (!transport->cancel_pkt)
>+ if (!transport || !transport->cancel_pkt)
> return -EOPNOTSUPP;
>
> return transport->cancel_pkt(vsk);
>--
>2.30.0
>
I can't see this patch on https://patchwork.kernel.org/project/netdevbpf/list/
Maybe because you forgot to CC the netdev maintainers.
Please next time use scripts/get_maintainer.pl
Anyway the patch LGTM, so
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] net/vmw_vsock: fix NULL pointer dereference
2021-02-05 17:13 ` Stefano Garzarella
@ 2021-02-07 0:57 ` Jakub Kicinski
0 siblings, 0 replies; 4+ messages in thread
From: Jakub Kicinski @ 2021-02-07 0:57 UTC (permalink / raw)
To: Stefano Garzarella
Cc: Norbert Slusarek, alex.popov, eric.dumazet, netdev, David S. Miller
On Fri, 5 Feb 2021 18:13:35 +0100 Stefano Garzarella wrote:
> On Fri, Feb 05, 2021 at 03:25:17PM +0100, Norbert Slusarek wrote:
> >From: Norbert Slusarek <nslusarek@gmx.net>
> >Date: Fri, 5 Feb 2021 13:12:06 +0100
> >Subject: [PATCH] net/vmw_vsock: fix NULL pointer dereference
> >
> >In vsock_stream_connect(), a thread will enter schedule_timeout().
> >While being scheduled out, another thread can enter vsock_stream_connect()
> >as well and set vsk->transport to NULL. In case a signal was sent, the
> >first thread can leave schedule_timeout() and vsock_transport_cancel_pkt()
> >will be called right after. Inside vsock_transport_cancel_pkt(), a null
> >dereference will happen on transport->cancel_pkt.
> >
> >Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
> >Reported-by: Norbert Slusarek <nslusarek@gmx.net>
> >Signed-off-by: Norbert Slusarek <nslusarek@gmx.net>
> >---
> > net/vmw_vsock/af_vsock.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> >diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
> >index 6894f21dc147..cb81cfb47a78 100644
> >--- a/net/vmw_vsock/af_vsock.c
> >+++ b/net/vmw_vsock/af_vsock.c
> >@@ -1233,7 +1233,7 @@ static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
> > {
> > const struct vsock_transport *transport = vsk->transport;
> >
> >- if (!transport->cancel_pkt)
> >+ if (!transport || !transport->cancel_pkt)
> > return -EOPNOTSUPP;
> >
> > return transport->cancel_pkt(vsk);
> >--
> >2.30.0
> >
>
> I can't see this patch on https://patchwork.kernel.org/project/netdevbpf/list/
>
> Maybe because you forgot to CC the netdev maintainers.
> Please next time use scripts/get_maintainer.pl
>
> Anyway the patch LGTM, so
>
> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Applied, thanks!
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] net/vmw_vsock: fix NULL pointer dereference
@ 2021-02-05 15:02 Norbert Slusarek
0 siblings, 0 replies; 4+ messages in thread
From: Norbert Slusarek @ 2021-02-05 15:02 UTC (permalink / raw)
To: kuba, sgarzare, alex.popov, eric.dumazet; +Cc: netdev
Forgot to send it to the networking maintainer, +CC Jakub Kicinski <kuba@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-02-07 0:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-05 14:25 [PATCH] net/vmw_vsock: fix NULL pointer dereference Norbert Slusarek
2021-02-05 17:13 ` Stefano Garzarella
2021-02-07 0:57 ` Jakub Kicinski
2021-02-05 15:02 Norbert Slusarek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).