netdev - Re: [PATCH RFC 1/2] vsock/virtio: fix kernel panic after device hot-unplug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 3 Jan 2019 15:09:39 +0100
From:   Stefano Garzarella <sgarzare@...hat.com>
To:     Stefan Hajnoczi <stefanha@...hat.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net
Subject: Re: [PATCH RFC 1/2] vsock/virtio: fix kernel panic after device hot-unplug

On Thu, Jan 3, 2019 at 11:03 AM Stefan Hajnoczi <stefanha@...hat.com> wrote:
>
> On Wed, Jan 02, 2019 at 11:01:27AM +0100, Stefano Garzarella wrote:
> > On Wed, Jan 2, 2019 at 10:39 AM Stefan Hajnoczi <stefanha@...hat.com> wrote:
> > >
> > > On Thu, Dec 20, 2018 at 01:15:34PM +0100, Stefano Garzarella wrote:
> > > > diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
> > > > index 5d3cce9e8744..9dae54698737 100644
> > > > --- a/net/vmw_vsock/virtio_transport.c
> > > > +++ b/net/vmw_vsock/virtio_transport.c
> > > > @@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void)
> > > >  {
> > > >       struct virtio_vsock *vsock = virtio_vsock_get();
> > > >
> > > > +     if (!vsock)
> > > > +             return VMADDR_CID_ANY;
> > > > +
> > > >       return vsock->guest_cid;
> > > >  }
> > >
> > > This looks unrelated to the rest of the patch.  Why is it necessary?
> >
> > It is needed because the "the_virtio_vsock" returned by
> > virtio_vsock_get() is initialized during the probe and freed during
> > the removal.
> > So, if we move the vsock_core_exit() in the virtio_vsock_exit(), can
> > happen that the virtio_transport_get_local_cid() is called when the
> > "the_virtio_vsock" is NULL.
> >
> > Do you think is better to split this patch?
>
> I'm curious which code paths reach virtio_transport_get_local_cid()
> after the virtio device has been removed.  ioctl
> IOCTL_VM_SOCKETS_GET_LOCAL_CID does.  Anything else?
>

Looking at af_vsock.c another path should be through the vsock_bind(),
if we initialize the vsock_core in the module_init, a user can bind
the socket when the virtio_vsock device is not probed or it is
removed.

Stefano