On Mon, Jul 14, 2025 at 04:20:56PM +0100, Will Deacon wrote:
>When receiving a vsock packet in the guest, only the virtqueue buffer
>size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately,
>virtio_vsock_skb_rx_put() uses the length from the packet header as the
>length argument to skb_put(), potentially resulting in SKB overflow if
>the host has gone wonky.
>
>Validate the length as advertised by the packet header before calling
>virtio_vsock_skb_rx_put().
>
>Cc: <stable@vger.kernel.org>
>Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
>Signed-off-by: Will Deacon <will@kernel.org>
>---
> net/vmw_vsock/virtio_transport.c | 12 ++++++++++--
> 1 file changed, 10 insertions(+), 2 deletions(-)
>
>diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
>index f0e48e6911fc..bd2c6aaa1a93 100644
>--- a/net/vmw_vsock/virtio_transport.c
>+++ b/net/vmw_vsock/virtio_transport.c
>@@ -624,8 +624,9 @@ static void virtio_transport_rx_work(struct work_struct *work)
> do {
> virtqueue_disable_cb(vq);
> for (;;) {
>+ unsigned int len, payload_len;
>+ struct virtio_vsock_hdr *hdr;
> struct sk_buff *skb;
>- unsigned int len;
>
> if (!virtio_transport_more_replies(vsock)) {
> /* Stop rx until the device processes already
>@@ -642,12 +643,19 @@ static void virtio_transport_rx_work(struct work_struct *work)
> vsock->rx_buf_nr--;
>
> /* Drop short/long packets */
>- if (unlikely(len < sizeof(struct virtio_vsock_hdr) ||
>+ if (unlikely(len < sizeof(*hdr) ||
pre-existing: in some part we use sizeof(*hdr) in other
VIRTIO_VSOCK_SKB_HEADROOM, I think we should try to uniform that, but of
course not for this series!
> len > virtio_vsock_skb_len(skb))) {
> kfree_skb(skb);
> continue;
> }
>
>+ hdr = virtio_vsock_hdr(skb);
>+ payload_len = le32_to_cpu(hdr->len);
>+ if (payload_len > len - sizeof(*hdr)) {
Since this is an hot path, should we use `unlikely`, like in the
previous check, to instruct the branch predictor?
The rest LGTM!
Thanks,
Stefano
>+ kfree_skb(skb);
>+ continue;
>+ }
>+
> virtio_vsock_skb_rx_put(skb);
> virtio_transport_deliver_tap_pkt(skb);
> virtio_transport_recv_pkt(&virtio_transport, skb);
>--
>2.50.0.727.gbf7dc18ff4-goog
>