netdev - Re: [PATCH RFC 1/2] vsock/virtio: fix kernel panic after device hot-unplug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Jan 2019 11:43:39 +0000
From:   Stefan Hajnoczi <stefanha@...hat.com>
To:     Stefano Garzarella <sgarzare@...hat.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net
Subject: Re: [PATCH RFC 1/2] vsock/virtio: fix kernel panic after device
 hot-unplug

On Thu, Jan 03, 2019 at 03:09:39PM +0100, Stefano Garzarella wrote:
> On Thu, Jan 3, 2019 at 11:03 AM Stefan Hajnoczi <stefanha@...hat.com> wrote:
> >
> > On Wed, Jan 02, 2019 at 11:01:27AM +0100, Stefano Garzarella wrote:
> > > On Wed, Jan 2, 2019 at 10:39 AM Stefan Hajnoczi <stefanha@...hat.com> wrote:
> > > >
> > > > On Thu, Dec 20, 2018 at 01:15:34PM +0100, Stefano Garzarella wrote:
> > > > > diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
> > > > > index 5d3cce9e8744..9dae54698737 100644
> > > > > --- a/net/vmw_vsock/virtio_transport.c
> > > > > +++ b/net/vmw_vsock/virtio_transport.c
> > > > > @@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void)
> > > > >  {
> > > > >       struct virtio_vsock *vsock = virtio_vsock_get();
> > > > >
> > > > > +     if (!vsock)
> > > > > +             return VMADDR_CID_ANY;
> > > > > +
> > > > >       return vsock->guest_cid;
> > > > >  }
> > > >
> > > > This looks unrelated to the rest of the patch.  Why is it necessary?
> > >
> > > It is needed because the "the_virtio_vsock" returned by
> > > virtio_vsock_get() is initialized during the probe and freed during
> > > the removal.
> > > So, if we move the vsock_core_exit() in the virtio_vsock_exit(), can
> > > happen that the virtio_transport_get_local_cid() is called when the
> > > "the_virtio_vsock" is NULL.
> > >
> > > Do you think is better to split this patch?
> >
> > I'm curious which code paths reach virtio_transport_get_local_cid()
> > after the virtio device has been removed.  ioctl
> > IOCTL_VM_SOCKETS_GET_LOCAL_CID does.  Anything else?
> >
> 
> Looking at af_vsock.c another path should be through the vsock_bind(),
> if we initialize the vsock_core in the module_init, a user can bind
> the socket when the virtio_vsock device is not probed or it is
> removed.

I've audited the bind code path and that looks alright.

There are not many other users of the_virtio_vsock and they look safe
too.

Stefan

Download attachment "signature.asc" of type "application/pgp-signature" (456 bytes)