netdev - [PATCH RFC net v2 3/3] vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250620-vsock-transports-toctou-v2-3-02ebd20b1d03@rbox.co>
Date: Fri, 20 Jun 2025 21:52:45 +0200
From: Michal Luczaj <mhal@...x.co>
To: Stefano Garzarella <sgarzare@...hat.com>, 
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
 Simon Horman <horms@...nel.org>, Stefan Hajnoczi <stefanha@...hat.com>
Cc: virtualization@...ts.linux.dev, netdev@...r.kernel.org, 
 linux-kernel@...r.kernel.org, Michal Luczaj <mhal@...x.co>
Subject: [PATCH RFC net v2 3/3] vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID
 to check also `transport_local`

Support returning VMADDR_CID_LOCAL in case no other vsock transport is
available.

Fixes: 0e12190578d0 ("vsock: add local transport support in the vsock core")
Suggested-by: Stefano Garzarella <sgarzare@...hat.com>
Signed-off-by: Michal Luczaj <mhal@...x.co>
---
man vsock(7) mentions IOCTL_VM_SOCKETS_GET_LOCAL_CID vs. VMADDR_CID_LOCAL:

   Ioctls
       ...
       IOCTL_VM_SOCKETS_GET_LOCAL_CID
              ...
              Consider using VMADDR_CID_ANY when binding instead of
              getting the local CID with IOCTL_VM_SOCKETS_GET_LOCAL_CID.

   Local communication
       ....
       The local CID obtained with IOCTL_VM_SOCKETS_GET_LOCAL_CID can be
       used for the same purpose, but it is preferable to use
       VMADDR_CID_LOCAL.

I was wondering it that would need some rewriting, since we're adding
VMADDR_CID_LOCAL as a possible ioctl's return value.
---
 net/vmw_vsock/af_vsock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index a1b1073a2c89f865fcdb58b38d8e7feffcf1544f..4bdb4016bd14d790f3d217d5063be64a1553b194 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -2577,6 +2577,8 @@ static long vsock_dev_do_ioctl(struct file *filp,
 		cid = vsock_transport_local_cid(&transport_g2h);
 		if (cid == VMADDR_CID_ANY)
 			cid = vsock_transport_local_cid(&transport_h2g);
+		if (cid == VMADDR_CID_ANY && transport_local)
+			cid = VMADDR_CID_LOCAL;

 		if (put_user(cid, p) != 0)
 			retval = -EFAULT;

-- 
2.49.0