On Thu, Jul 17, 2025 at 10:01:09AM +0100, Will Deacon wrote:
>When receiving a vsock packet in the guest, only the virtqueue buffer
>size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately,
>virtio_vsock_skb_rx_put() uses the length from the packet header as the
>length argument to skb_put(), potentially resulting in SKB overflow if
>the host has gone wonky.
>
>Validate the length as advertised by the packet header before calling
>virtio_vsock_skb_rx_put().
>
>Cc: <stable@vger.kernel.org>
>Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
>Signed-off-by: Will Deacon <will@kernel.org>
>---
> net/vmw_vsock/virtio_transport.c | 12 ++++++++++--
> 1 file changed, 10 insertions(+), 2 deletions(-)
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
>
>diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
>index f0e48e6911fc..eb08a393413d 100644
>--- a/net/vmw_vsock/virtio_transport.c
>+++ b/net/vmw_vsock/virtio_transport.c
>@@ -624,8 +624,9 @@ static void virtio_transport_rx_work(struct work_struct *work)
> do {
> virtqueue_disable_cb(vq);
> for (;;) {
>+ unsigned int len, payload_len;
>+ struct virtio_vsock_hdr *hdr;
> struct sk_buff *skb;
>- unsigned int len;
>
> if (!virtio_transport_more_replies(vsock)) {
> /* Stop rx until the device processes already
>@@ -642,12 +643,19 @@ static void virtio_transport_rx_work(struct work_struct *work)
> vsock->rx_buf_nr--;
>
> /* Drop short/long packets */
>- if (unlikely(len < sizeof(struct virtio_vsock_hdr) ||
>+ if (unlikely(len < sizeof(*hdr) ||
> len > virtio_vsock_skb_len(skb))) {
> kfree_skb(skb);
> continue;
> }
>
>+ hdr = virtio_vsock_hdr(skb);
>+ payload_len = le32_to_cpu(hdr->len);
>+ if (unlikely(payload_len > len - sizeof(*hdr))) {
>+ kfree_skb(skb);
>+ continue;
>+ }
>+
> virtio_vsock_skb_rx_put(skb);
> virtio_transport_deliver_tap_pkt(skb);
> virtio_transport_recv_pkt(&virtio_transport, skb);
>--
>2.50.0.727.gbf7dc18ff4-goog
>