From nobody Mon Oct 6 22:49:02 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8409F28982C; Thu, 17 Jul 2025 09:01:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1752742886; cv=none; b=Ga2P+tRIgBpO8AvswoxPcgXcp5ughl+dO2KUenqPE6aDDdnNMK4vPA19xlkQRn5L+ZrLUrnFhpPhFzjs8JrezFlXIlsj/1NI1ULZ8+lz0TnxriTHi3Lg1nwf/95WxJ5IdG5BTmm1yYwt1lEIhRgrTeJhAhMz1mYGByw7lpuH6tY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1752742886; c=relaxed/simple; bh=EsK5W6bKoLJTlrARe6cyHuC1eYdjdkYRPm1cbOahWk8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=kBZGCYwoHrNNsJ3NGaXWQiFAquctOxkzbZZ+19M/vy80lzLoJAo2SGB8AcQ1Hy6k+7Trliq+SyOuQH6IIYKlCJJlPT2BDFFI1dj6Cd4YecWIYJy2RPHuFGMD/KUFP46e88X10gjjTjrKep3l7cICQy/gx+lVLIIlsdqsS4UTbXA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=UEBGyB45; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="UEBGyB45" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CE273C4CEED; Thu, 17 Jul 2025 09:01:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1752742886; bh=EsK5W6bKoLJTlrARe6cyHuC1eYdjdkYRPm1cbOahWk8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UEBGyB45TrIiT5GWYzekGwu7EMmsz4w1KBIN+8Tyh9pHDt9o73hKh8e0qBrHQL6CB VdMMF3SAclC6iCeR6jDj4umG8X2Ceon46V1DCOqN6WCO1tlfciOklrVctOS3rgjuwu 5FPVVKYFngKj9yQdEa9hUDlkUOUs9AgiRvGlG/1b2APkjgyaRAUZEaME8iYYQO7CjJ BSSWCzK9B61Y2Pns7DCRa/v6KTYvLWizvB+zDReyzZJsVFG9LaR/BgPepZcR1skFtt 1+MN6FkrxudJi41fAPqePsUHpFxF+/z6dhJaptAsoNEyocxFtuDh1YmjHrIF58F6gs w6GKHlGCjqvsQ== From: Will Deacon To: linux-kernel@vger.kernel.org Cc: Will Deacon , Keir Fraser , Steven Moreland , Frederick Mayle , Stefan Hajnoczi , Stefano Garzarella , "Michael S. Tsirkin" , Jason Wang , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , netdev@vger.kernel.org, virtualization@lists.linux.dev, stable@vger.kernel.org Subject: [PATCH v4 1/9] vhost/vsock: Avoid allocating arbitrarily-sized SKBs Date: Thu, 17 Jul 2025 10:01:08 +0100 Message-Id: <20250717090116.11987-2-will@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250717090116.11987-1-will@kernel.org> References: <20250717090116.11987-1-will@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vhost_vsock_alloc_skb() returns NULL for packets advertising a length larger than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE in the packet header. However, this is only checked once the SKB has been allocated and, if the length in the packet header is zero, the SKB may not be freed immediately. Hoist the size check before the SKB allocation so that an iovec larger than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + the header size is rejected outright. The subsequent check on the length field in the header can then simply check that the allocated SKB is indeed large enough to hold the packet. Cc: Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Reviewed-by: Stefano Garzarella Signed-off-by: Will Deacon --- drivers/vhost/vsock.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 802153e23073..66a0f060770e 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -344,6 +344,9 @@ vhost_vsock_alloc_skb(struct vhost_virtqueue *vq, =20 len =3D iov_length(vq->iov, out); =20 + if (len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM) + return NULL; + /* len contains both payload and hdr */ skb =3D virtio_vsock_alloc_skb(len, GFP_KERNEL); if (!skb) @@ -367,8 +370,7 @@ vhost_vsock_alloc_skb(struct vhost_virtqueue *vq, return skb; =20 /* The pkt is too big or the length in the header is invalid */ - if (payload_len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || - payload_len + sizeof(*hdr) > len) { + if (payload_len + sizeof(*hdr) > len) { kfree_skb(skb); return NULL; } --=20 2.50.0.727.gbf7dc18ff4-goog