From nobody Mon Sep 28 09:59:41 2026 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82D31389105 for ; Sun, 23 Aug 2026 17:59:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787507989; cv=none; b=AYD+sT8p8wYuipu+Rfv3jtG42nemCYtoIsfgT6pz9noAVOHeMA1HzTC0NA8IppqOtUeR4W1IrRyMJWppXaYhq5DrS08gOuIdJsUZ/83/Vas9BYragrqWfXLWg0107YXJ4NMDRQd/jQeqFYfQRG7LPLToREU5ydMEVOOi1oT6cFk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787507989; c=relaxed/simple; bh=FAhg6Y+Gf2hFXGS3OvtnnmqFkb5b9j/RA3QH1+XyYfI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Tybn4CCr0TyyONVoTcmYXkTgiWM8Q2BrDVaXUsfPUyD6T5i4wHmpiJ2yfrlm56mCwWyCgani+DRaDaYDKR/Z7mQ4694O0kiiSBKTMak9C1G598vh/j0QDw/XR88RueqMSMot+WsHdnu8MbmxoD+6uq9yDkY8coBMRAXgxrKXgig= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Od6O3a6O; arc=none smtp.client-ip=209.85.216.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Od6O3a6O" Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-395cf2535acso2135219a91.1 for ; Sun, 23 Aug 2026 10:59:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787507982; x=1788112782; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aM0XuwG9Af69RwHZUicdMbCmsYfcoS0svbHZa6lYfL0=; b=Od6O3a6O35YsujqMNT33cRxr7+i/Mc3cq4GKPkMBddo0a6vTa1fy8PMZFCHIV68wg3 8O2Kwf/9QH+mmM4OKjNlmYtKVzU4hvLY8ZEaUa2znWiiXXHQX77xJq4Ste/18ysb63/3 AHli4mlccj4pKi6abzUVNbzbPtd5nmCRctzshpzFLssHmouh1HUK8y7F1e6/HBRmNSjT DESwtLdRvIFnPK0WzaH8Pdcj1ILJkWrEbiFZmj0gs63+sciCEoWlkNLkD+R6fwy+cQ51 t/JhB5fxPHH+zcvUGhl1QafV+HV/jEQXIOWfGebEwrTuA7kihiXS5YEkCmRuJVmZb/bz etug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787507982; x=1788112782; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=aM0XuwG9Af69RwHZUicdMbCmsYfcoS0svbHZa6lYfL0=; b=tIq9MdvJQjzgT2y0bccfbSJURf1+EE9XKX1o6mJyjLnXfXZBJ8S0ZjyWweF3n8ZHQc 0kwFZVJ9MU/iiT5RyHUpUJotrLEwYhSeLZH+ZZRqYeZwtJp+QUgDn1SIIk4oa6YOpnlM M+yvo604HOhaLCQPRdGp/99F4caBcZkuKHHKgEYOJiZsallF2rataSDQNclZ7/gvzei3 Pwwj/M37Mkjj01ZsFbNczhMLLsiKEMGJ7Fy6JMMlqSkvQc99gAvYaYdl0n0auH1wbOBa NXKkgDRMn1r+Ozkx01l2E5FkadyU7Yz2CexF191jY+zjdeJe93RubyKHjjz3fpq+FBL1 Qzvg== X-Forwarded-Encrypted: i=1; AHgh+RoR90fS0j51N08bSQXgJt/rWpKN3V/USfm1+MIfLUo4es3yNXnUZmZvZsBqGInmlTfKFB/AfRq6cD2VQco=@vger.kernel.org X-Gm-Message-State: AFuF++l5QRPMTOulay7oeqaAoEyzRZ3Lmcc3KOpKOhhMfaspXAA12fg5 qMsZBqqtpFzvwNBHNnmxfKbZx8wl9LelCMZMK7Auj1nPWEii+8RJ4L3G X-Gm-Gg: AR+sD117TxO429MBRPvZIYb4CHTpVsQ6TkFRoiuTamaSQLEmg7QdATqb1TUpZ+G6c79 K5mkRIYLLGfAIF7ORjgdeXRJfd8n1BWYyngwSvr4oK2/vpRZMoTlaSxmdvAJ2x+iSJq1NXb4OFr zTkKFA3exo2nn8y3vzxNQJDfrwqbMgHijcYZjso0Z5ONvbEamuvkGYmEZFgRyM3vnsWe4a+1UaC hMVvvDknA6lip4r00mAyhEIJjmOswlR29mcsZK4CQffcitosTXE3vgjL+Qn1pHvq01PQwdpDsLd jy7HL0A+YrMrzBviijF8X/2HiDlnowo6MfRM70lNc1JPsiQR0ly9Xp2bDA/DZgkM0DYDDa0TvYu HvC5wzbZsn2bz6Xuc5W2OPJ0nGqlBvWnhMuftz4HieIp+C8U2Q/l+hpOnK52jrrDBuCDQV4IB6n oyRGB64/8PqXQk6KPKNCSDNzMRcAFo++dUzDO6oZV/hXOsjxkl3OYTU70jaflLEF4G/3i4+orA X-Received: by 2002:a17:90b:1dd2:b0:385:3ab:fecb with SMTP id 98e67ed59e1d1-395c4c98f17mr20491383a91.4.1787507982541; Sun, 23 Aug 2026 10:59:42 -0700 (PDT) Received: from ancienth-X870E-Nova-WiFi ([125.186.72.2]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-395c8fd34d9sm3722818a91.1.2026.08.23.10.59.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 23 Aug 2026 10:59:42 -0700 (PDT) From: Daehyeon Ko <4ncienth@gmail.com> To: netdev@vger.kernel.org Cc: sgarzare@redhat.com, stefanha@redhat.com, bobbyeshleman@gmail.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, mst@redhat.com, jasowangio@gmail.com, xuanzhuo@linux.alibaba.com, eperezma@redhat.com, bryan-bt.tan@broadcom.com, vishnu.dasa@broadcom.com, bcm-kernel-feedback-list@broadcom.com, virtualization@lists.linux.dev, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v3 1/2] vsock/virtio: validate packet source for connected sockets Date: Mon, 24 Aug 2026 02:58:57 +0900 Message-ID: <20260823175858.351431-2-4ncienth@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260823175858.351431-1-4ncienth@gmail.com> References: <20260823175858.351431-1-4ncienth@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening and connecting sockets, but sockets remain in the bound table after connect(), so it can also return a non-listening socket. The fallback does not validate the source address. In TCP_SYN_SENT, a RESPONSE from an unrelated source can transition the victim socket to TCP_ESTABLISHED while its stored remote address remains unchanged. Subsequent RW packets from that source are delivered through the same destination-only fallback. This was reproduced with capability-empty processes under different UIDs. The attacker discovered the target tuple through unprivileged AF_VSOCK sock_diag and caused the victim socket to read 16 attacker-chosen bytes; the intended peer-side socket read 0 of those 16 bytes. Add vsock_check_source() to validate the transport, source port and source CID against the peer stored in a non-listening socket. The local transport is the CID exception because its packets are generated internally with VMADDR_CID_LOCAL as their source, including connections using CID aliases. Use the helper after lock_sock() in the virtio receive path. Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") Closes: https://lore.kernel.org/netdev/20260813121236.2328599-1-4ncienth@gm= ail.com/ Cc: stable@vger.kernel.org Suggested-by: Stefano Garzarella Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> Reviewed-by: Bobby Eshleman --- include/net/af_vsock.h | 3 +++ net/vmw_vsock/af_vsock.c | 32 +++++++++++++++++++++++++ net/vmw_vsock/virtio_transport_common.c | 3 ++- 3 files changed, 37 insertions(+), 1 deletion(-) diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index 3357ee62d..5549298c1 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -229,6 +229,9 @@ struct sock *vsock_find_bound_socket_net(struct sockadd= r_vm *addr, struct sock *vsock_find_connected_socket_net(struct sockaddr_vm *src, struct sockaddr_vm *dst, struct net *net); +bool vsock_check_source(const struct vsock_sock *vsk, + const struct vsock_transport *transport, + const struct sockaddr_vm *src); void vsock_remove_sock(struct vsock_sock *vsk); void vsock_for_each_connected_socket(struct vsock_transport *transport, void (*fn)(struct sock *sk)); diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index a33b2a2d3..f840498b5 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -438,6 +438,38 @@ struct sock *vsock_find_connected_socket(struct sockad= dr_vm *src, } EXPORT_SYMBOL_GPL(vsock_find_connected_socket); =20 +/** + * vsock_check_source - validate a packet source against a socket peer + * @vsk: socket receiving the packet + * @transport: transport receiving the packet + * @src: source address from the packet + * + * Return: true if the packet arrived on the socket's assigned transport a= nd + * its source matches the stored peer. Loopback packets are generated + * internally and always use the local CID as their source, including + * connections using a valid CID alias. + * + * The caller must hold the socket lock and must not call this for listeni= ng + * sockets, which accept packets from any source and have no assigned + * transport. + */ +bool vsock_check_source(const struct vsock_sock *vsk, + const struct vsock_transport *transport, + const struct sockaddr_vm *src) +{ + if (vsk->transport !=3D transport) + return false; + + if (src->svm_port !=3D vsk->remote_addr.svm_port) + return false; + + if (src->svm_cid =3D=3D vsk->remote_addr.svm_cid) + return true; + + return transport->get_local_cid() =3D=3D VMADDR_CID_LOCAL; +} +EXPORT_SYMBOL_GPL(vsock_check_source); + void vsock_remove_sock(struct vsock_sock *vsk) { /* Transport reassignment must not remove the binding. */ diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio= _transport_common.c index e4ebaa70f..6301c108a 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -1823,7 +1823,8 @@ void virtio_transport_recv_pkt(struct virtio_transpor= t *t, * lock_sock (note: listener sockets are not assigned to any transport) */ if (sock_flag(sk, SOCK_DONE) || - (sk->sk_state !=3D TCP_LISTEN && vsk->transport !=3D &t->transport)) { + (sk->sk_state !=3D TCP_LISTEN && + !vsock_check_source(vsk, &t->transport, &src))) { (void)virtio_transport_reset_no_sock(t, skb, net); release_sock(sk); sock_put(sk); --=20 2.54.0 From nobody Mon Sep 28 09:59:41 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1BC5038BF62 for ; Sun, 23 Aug 2026 17:59:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787507992; cv=none; b=DYTt+SXxI0sSF12m8s0Hz8CZYvbA4s2/7EXreoO8QftfibRGiuPnwpSw9zi9Wa4ICYt6BoR7/IFFRKhwiFK/G9E1k51ef9gV4DpKQPKwi2slJu7dZ7xUftfV8gWIy/OhUU5YnLzE+Aa1LbwICuk4Etkiwn05aImHxGKNYpJjmfU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787507992; c=relaxed/simple; bh=Q5N8akU4x+F36ss1pZ0xBmq2Yh+ClMoeMJuX3SACBjM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oWi7ash8vIXO+5bIu+8RjkzowW3nHIb7LckYMXBsr5mK8GGe1Syk41XBT3mtABR0QKhpPh5kw1PmCS9BKwxRStnJ1HM3REi5N2PPN89Obl9aFkhp5pR7mGvblX8cX7zb1N8GElen5fXbdlwMUKRIJBIUYxpOoih/sWEhxEbtovo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mNmokkrZ; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mNmokkrZ" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-38deea72eebso2914498a91.1 for ; Sun, 23 Aug 2026 10:59:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787507987; x=1788112787; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ECOspUthc7jBrs5mtjKd9RwO1oTEgx0ts6iTJsWVuOY=; b=mNmokkrZ6k83OPsCtcYt+1K1ita0ZnBsb+LN6njAswk34m7i3jT5lEVzMy8/+I1LwI 44PhWOrB97C0XM6eadbCtbRAy1ZnPgBkBniNsyQ7sEdtYdo8X+u4o7i1QXY7SUAEZJHC ykWtp15HKnKK0gDZNy+/DjaUCfHqijg9Rn2BLvW/WClaypeznOJebPE+PALg6wphA24f lo1vR2kgGVENz4WWCsqTFRZ0Pv7Er02kVYYp1iA0Js7E66bddUyKvbvuchunk/71Mx03 01uK68g41RQgPi8t/EUp3g9AhYCsGEX/1hoW6O04gUYaMB+uHdzo60A2L1h4EzPcMd7F 98gg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787507987; x=1788112787; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ECOspUthc7jBrs5mtjKd9RwO1oTEgx0ts6iTJsWVuOY=; b=PUaOEolIjiFbRyvjUm97gAqUNFeqmq12a5ow5wTftUffnQImatrlj5QBy813sA7Aho +FI5NYibEKcxe3gNqkjibrMEnIP9bDZlOnGV57mpxJMgmmNB6Pm+MSJmGb9NtqkYIUlg /YE2YMu757EsYCPO6VfDPAWu7KGYnjR3chxX9V/pMKxwwmObKrYb9IZ1DDkJiUsUdInc RzcytLQfS1VJ+P3ZPsSwnm1jU2dQSeLyWjbxUYyBdDXEmneWKNHZHk37F0/eGFf9sNVb aU68HT7FjYr0KTAhZKQNaUlCi7fhk/fd+JFMO9Urca15pq1o5IEPH+DqzA3KYl3oTRCM a/uw== X-Forwarded-Encrypted: i=1; AHgh+RrlZ7PlBjOO7GeRtu+aAQToWEqFzlrtEsHxPY3sm8l1gjTxa/0aQLNY9nUO5/R1yynur6JmQyI3rwjLFEA=@vger.kernel.org X-Gm-Message-State: AFuF++mhLc1VAhwlaa8txU61TSMFsAV+JZ2LJEUhFBn/hcdV1RnQ5Jeb iXkza4ykKDIBXyVXC2zvRGHXyTh30g1Ukt1eNqeN4Q6MsG8uPQ0oY7Wr X-Gm-Gg: AR+sD12SwOl5cap+wVFkJnRgG/mtC8QH78JQx4YceQ8NE2BtDUFsD2rZ3/q2lsn9Rqx xu84t+SlDaG5NaA4WO9+H93UL0nY0ZCsox2o+A8R5oyFHB07kiaFCrNRMvOosNRwGR/Aj66LroI gmg/csc1oqAl2+4z8SAyEj294IS1FFozoxVKm5+vjbMyW17Yjeu+X3U0IH/5qP4ZgTz5v4w1l6k SceUdReQ5bsltCo1pU7Okv5qv6v4td5tpOSCWDFsyjWr8MkUBK2gB9up6sd4ydnGpWaU8vE+mOE lp3T6lqeY4jp88BdFjtfkZklGMNVJsFwUQzh9PSpdJCnyeHZd5bkj9e9LfhovdYOWwYHSXJ+CwI FXklNbYvol+nrEPZJ0iWNz7EFFKYakBKkrJXgqeby+G1uyb1IFDbCuBlwPn7TAn6N8frT4baML2 wnu7pAoYLCVIHHoVdVDtCUJc5dHpvrLFyXafrakXgLwl/jPzDwYqRIKKm7kGVxZ/JfOX6za41d X-Received: by 2002:a17:90b:4c84:b0:38e:2517:5d1f with SMTP id 98e67ed59e1d1-395df2595d4mr19966783a91.9.1787507987364; Sun, 23 Aug 2026 10:59:47 -0700 (PDT) Received: from ancienth-X870E-Nova-WiFi ([125.186.72.2]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-395c8fd34d9sm3722818a91.1.2026.08.23.10.59.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 23 Aug 2026 10:59:46 -0700 (PDT) From: Daehyeon Ko <4ncienth@gmail.com> To: netdev@vger.kernel.org Cc: sgarzare@redhat.com, stefanha@redhat.com, bobbyeshleman@gmail.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, mst@redhat.com, jasowangio@gmail.com, xuanzhuo@linux.alibaba.com, eperezma@redhat.com, bryan-bt.tan@broadcom.com, vishnu.dasa@broadcom.com, bcm-kernel-feedback-list@broadcom.com, virtualization@lists.linux.dev, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Sashiko Subject: [PATCH net v3 2/2] vsock/vmci: validate packet source for connected sockets Date: Mon, 24 Aug 2026 02:58:58 +0900 Message-ID: <20260823175858.351431-3-4ncienth@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260823175858.351431-1-4ncienth@gmail.com> References: <20260823175858.351431-1-4ncienth@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a non-listening socket without checking whether the packet came from its stored peer. This was reproduced with two VMCI contexts. A RST from the context not stored in a TCP_SYN_SENT socket reset that socket after it was selected by the destination-only lookup. VMCI can process notification packets in bottom-half context when the socket is not owned by user context, or defer packets to a workqueue. Use vsock_check_source() after taking the socket lock in the bottom-half path, and recheck after lock_sock() in the workqueue path. Listening sockets continue to accept packets from any source. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Sashiko Closes: https://lore.kernel.org/netdev/20260814121255.6B5001F000E9@smtp.ker= nel.org/ Cc: stable@vger.kernel.org Suggested-by: Stefano Garzarella Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> --- net/vmw_vsock/vmci_transport.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c index 1c4ee039c..b612a9893 100644 --- a/net/vmw_vsock/vmci_transport.c +++ b/net/vmw_vsock/vmci_transport.c @@ -680,11 +680,13 @@ static int vmci_transport_recv_stream_cb(void *data, = struct vmci_datagram *dg) struct vmci_transport_packet *pkt; struct vsock_sock *vsk; bool bh_process_pkt; + bool drop_pkt; int err; =20 sk =3D NULL; err =3D VMCI_SUCCESS; bh_process_pkt =3D false; + drop_pkt =3D false; =20 /* Ignore incoming packets from resources that aren't vsock * implementations. @@ -765,17 +767,26 @@ static int vmci_transport_recv_stream_cb(void *data, = struct vmci_datagram *dg) bh_lock_sock(sk); =20 if (!sock_owned_by_user(sk)) { - /* The local context ID may be out of date, update it. */ - vsk->local_addr.svm_cid =3D dst.svm_cid; + if (sk->sk_state !=3D TCP_LISTEN && + !vsock_check_source(vsk, &vmci_transport, &src)) { + drop_pkt =3D true; + err =3D VMCI_ERROR_NO_ACCESS; + } else { + /* The local context ID may be out of date, update it. */ + vsk->local_addr.svm_cid =3D dst.svm_cid; =20 - if (sk->sk_state =3D=3D TCP_ESTABLISHED) - vmci_trans(vsk)->notify_ops->handle_notify_pkt( - sk, pkt, true, &dst, &src, - &bh_process_pkt); + if (sk->sk_state =3D=3D TCP_ESTABLISHED) + vmci_trans(vsk)->notify_ops->handle_notify_pkt(sk, pkt, true, + &dst, &src, + &bh_process_pkt); + } } =20 bh_unlock_sock(sk); =20 + if (drop_pkt) + goto out; + if (!bh_process_pkt) { struct vmci_transport_recv_pkt_info *recv_pkt_info; =20 @@ -900,6 +911,7 @@ static void vmci_transport_recv_pkt_work(struct work_st= ruct *work) { struct vmci_transport_recv_pkt_info *recv_pkt_info; struct vmci_transport_packet *pkt; + struct sockaddr_vm src; struct sock *sk; =20 recv_pkt_info =3D @@ -908,6 +920,10 @@ static void vmci_transport_recv_pkt_work(struct work_s= truct *work) pkt =3D &recv_pkt_info->pkt; =20 lock_sock(sk); + vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port); + if (sk->sk_state !=3D TCP_LISTEN && + !vsock_check_source(vsock_sk(sk), &vmci_transport, &src)) + goto out; =20 /* The local context ID may be out of date. */ vsock_sk(sk)->local_addr.svm_cid =3D pkt->dg.dst.context; @@ -937,6 +953,7 @@ static void vmci_transport_recv_pkt_work(struct work_st= ruct *work) break; } =20 +out: release_sock(sk); kfree(recv_pkt_info); /* Release reference obtained in the stream callback when we fetched --=20 2.54.0