From nobody Mon Sep 28 05:42:44 2026 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 070F8233947 for ; Wed, 26 Aug 2026 00:40:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787704806; cv=none; b=pW5PGD+GD/6hwR75xFuq34gUByUX+zZXkFqbGQ5dzTIz2NlSgPPQkmTy31sYx9GKOacw0Z18686gr/SDb5b+lE6h11esg3XdgfbiSRbCOTN5D6DKr9hhHBGA0QeItTBEBrT0t7JRZLdS0AMUZJiIsBGZgCHlVvVxPIHpffgMwPA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787704806; c=relaxed/simple; bh=QX/vn9JHBDF1P5ti7air7BXUMt6TE73hYnNrwXMaVVM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dXY1jQmn9VLTNsUIf6Zo8BX83J+cGJL9IK1iX4gnupGhfD4SfSvVUJJWu7q+Lp55/3E9+4ADB11mzYcT5UN9AwHFZw//P0zpPdo5cGPsctUdMyN2fQS/zMGf4uiCeoxVApmzGESOSqB0dzcj8Coqp6NfsN265z9d1NoJePHvWJc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=i+aHCJdU; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="i+aHCJdU" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-84eb992a881so386304b3a.2 for ; Tue, 25 Aug 2026 17:40:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787704804; x=1788309604; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=a/eP+e7q3408itBdeYjBe53xJJY4zYLdPkL6W0uiwF0=; b=i+aHCJdUmTYuaEgvVtcpVA3B9urc/aM0SkRp8X3nRjrcOuGRatHkVV0jEWOFFDThRi SHrQTq+ikJkAk4nVsRKOOUBVrgDFQXu3Q9buZsfx2QdpaLed894N5tBoLDUxU8ayvXIq WjFqDSdFwIj8pfH+L25wCjn/YGay8SvdtCj228YAfyTi//Nk35XiU9Uhl0xhwSMcVl52 BFEL+GbyyGlm7sGSZhuthmMUcfcS/BtpjSDM/eZfsUs7hpVCwN5RdTGQJuN5smfF7NDA DOQUK87y09FF7axWI8XZbV0/0wmqrL6XenrcmafJQ+NqkU//gbJrww5ua8BW47eznIx9 yPhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787704804; x=1788309604; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=a/eP+e7q3408itBdeYjBe53xJJY4zYLdPkL6W0uiwF0=; b=QsKizrBbU1eJm4ksjg3yQ1cPueqTyjy0FHM85E8t7ZoPToZlaaSw+v2CmGGpvuycMq nPpePB0dbILjQkUAxF4/7VDVz108QF8OJ7pBRYeKJzWPWR7ropXqgVH1MIJPvaOxIpKN ss/GZxhsMDIuzJ7VUuxHx5ZpIsol02LQtNBbtX3VNgXdiMuFDe4BgMN8gOo6TJcurouJ BaLbRSsmYVA5JMpNZ5qNdo8YSH9JViE+E/cuAb+UWoEyau1mXQEJD+w2w6IhjMsqwHAj oJGCN38Q1YGCNxU44F8nN8Dtz0Q1sFji/dxccRVi7jxOZbSDeVDZenBPET17fh3HtzMf 30YA== X-Forwarded-Encrypted: i=1; AHgh+RojwXKiCqQrO/NafnViw84TaZWEXjRWFa5krsPY5e5u+z3nRQ9p/aOZFscPJuiuoANZInq7qX40LA3grmY=@vger.kernel.org X-Gm-Message-State: AFuF++kpvSNkV8zOlik/jhn+tzTt1WSdu4+vqrhBkTBKqnd+P7Yj5/Mi bRXw4g3qegfrqInyaIL7CyfFA0yfLeq6wiYEGVohURoFkRZrTKSNLuOt X-Gm-Gg: AR+sD10nx6sm0Ts+Nkmk5LcSNVsgD9sX2Hegmn3xOnAR3nIYwoXap/uvjWHUPcb0qIA RkZ5tF6Xig0u5S11yLRCF4OPrKEsQFxl/yLlhKADdrRZLWkhfsl4cBfl+8jMZ35MUTwkLkxwFY/ ucFE7VYxJuJQKcZHU72n7p2DLDbP7NtTQsn3N5OkcrE9kEBDA/sVg1sLl246WSwNh71tXV40Fir yltkKKtBdWTDnsi3M85RtOzVtEhp3jc0fHOhreOQgrmY0ZLI5lZ8agbIb6VwGLoomxMuQ46MMZq ij5bPOfjQ16bMat84Ow2YhsUVVXxwEMSxAETDzII61+fCyWyVFnf/yCZwVX3x74hJeuy7OWuqZ5 QxqX5a8dPYdImwgxTxeHs6uF5LiixaLdOeTGsuYtQF/l4/lFFP62nDTFQGmfvCQw0UrEyyCZNWR pXO7ZjgtYh42tckObkpS8qF3yn0w+QNirvUvvPZroJ+XF5NkP4J5IlSiUood2+iKNpIKNcbbNM X-Received: by 2002:a05:6a00:4f92:b0:848:2e3c:9955 with SMTP id d2e1a72fcca58-85371fa599amr4496713b3a.4.1787704804199; Tue, 25 Aug 2026 17:40:04 -0700 (PDT) Received: from ancienth-X870E-Nova-WiFi ([125.186.72.2]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8535cdc038dsm339377b3a.38.2026.08.25.17.39.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 17:40:03 -0700 (PDT) From: Daehyeon Ko <4ncienth@gmail.com> To: netdev@vger.kernel.org Cc: sgarzare@redhat.com, stefanha@redhat.com, bobbyeshleman@gmail.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, mst@redhat.com, jasowangio@gmail.com, xuanzhuo@linux.alibaba.com, eperezma@redhat.com, bryan-bt.tan@broadcom.com, vishnu.dasa@broadcom.com, bcm-kernel-feedback-list@broadcom.com, virtualization@lists.linux.dev, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net v4 1/2] vsock/virtio: validate packet source for connected sockets Date: Wed, 26 Aug 2026 09:39:27 +0900 Message-ID: <20260826003929.966160-2-4ncienth@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260826003929.966160-1-4ncienth@gmail.com> References: <20260826003929.966160-1-4ncienth@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening and connecting sockets, but sockets remain in the bound table after connect(), so it can also return a non-listening socket. The fallback does not validate the source address. In TCP_SYN_SENT, a RESPONSE from an unrelated source can transition the victim socket to TCP_ESTABLISHED while its stored remote address remains unchanged. Subsequent RW packets from that source are delivered through the same destination-only fallback. This was reproduced with capability-empty processes under different UIDs. The attacker discovered the target tuple through unprivileged AF_VSOCK sock_diag and caused the victim socket to read 16 attacker-chosen bytes; the intended peer-side socket read 0 of those 16 bytes. Add vsock_check_source() to validate the transport, source port and source CID against the peer stored in a non-listening socket. The local transport is the CID exception because its packets are generated internally with VMADDR_CID_LOCAL as their source, including connections using CID aliases. Use the helper after lock_sock() in the virtio receive path. Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") Closes: https://lore.kernel.org/netdev/20260813121236.2328599-1-4ncienth@gm= ail.com/ Cc: stable@vger.kernel.org Suggested-by: Stefano Garzarella Reviewed-by: Bobby Eshleman Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> --- include/net/af_vsock.h | 3 +++ net/vmw_vsock/af_vsock.c | 32 +++++++++++++++++++++++++ net/vmw_vsock/virtio_transport_common.c | 3 ++- 3 files changed, 37 insertions(+), 1 deletion(-) diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index 3357ee62d..5549298c1 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -229,6 +229,9 @@ struct sock *vsock_find_bound_socket_net(struct sockadd= r_vm *addr, struct sock *vsock_find_connected_socket_net(struct sockaddr_vm *src, struct sockaddr_vm *dst, struct net *net); +bool vsock_check_source(const struct vsock_sock *vsk, + const struct vsock_transport *transport, + const struct sockaddr_vm *src); void vsock_remove_sock(struct vsock_sock *vsk); void vsock_for_each_connected_socket(struct vsock_transport *transport, void (*fn)(struct sock *sk)); diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index a33b2a2d3..f840498b5 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -438,6 +438,38 @@ struct sock *vsock_find_connected_socket(struct sockad= dr_vm *src, } EXPORT_SYMBOL_GPL(vsock_find_connected_socket); =20 +/** + * vsock_check_source - validate a packet source against a socket peer + * @vsk: socket receiving the packet + * @transport: transport receiving the packet + * @src: source address from the packet + * + * Return: true if the packet arrived on the socket's assigned transport a= nd + * its source matches the stored peer. Loopback packets are generated + * internally and always use the local CID as their source, including + * connections using a valid CID alias. + * + * The caller must hold the socket lock and must not call this for listeni= ng + * sockets, which accept packets from any source and have no assigned + * transport. + */ +bool vsock_check_source(const struct vsock_sock *vsk, + const struct vsock_transport *transport, + const struct sockaddr_vm *src) +{ + if (vsk->transport !=3D transport) + return false; + + if (src->svm_port !=3D vsk->remote_addr.svm_port) + return false; + + if (src->svm_cid =3D=3D vsk->remote_addr.svm_cid) + return true; + + return transport->get_local_cid() =3D=3D VMADDR_CID_LOCAL; +} +EXPORT_SYMBOL_GPL(vsock_check_source); + void vsock_remove_sock(struct vsock_sock *vsk) { /* Transport reassignment must not remove the binding. */ diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio= _transport_common.c index e4ebaa70f..6301c108a 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -1823,7 +1823,8 @@ void virtio_transport_recv_pkt(struct virtio_transpor= t *t, * lock_sock (note: listener sockets are not assigned to any transport) */ if (sock_flag(sk, SOCK_DONE) || - (sk->sk_state !=3D TCP_LISTEN && vsk->transport !=3D &t->transport)) { + (sk->sk_state !=3D TCP_LISTEN && + !vsock_check_source(vsk, &t->transport, &src))) { (void)virtio_transport_reset_no_sock(t, skb, net); release_sock(sk); sock_put(sk); base-commit: dc4b95b8fee95113587e93ca116356032d271371 From nobody Mon Sep 28 05:42:44 2026 Received: from mail-pf1-f171.google.com (mail-pf1-f171.google.com [209.85.210.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 317B022A7F6 for ; Wed, 26 Aug 2026 00:40:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787704811; cv=none; b=BUdEj3p9S7hbBBlYAFazUqew2AWNV4GXOVn99hDZjZIG1Ldg8LTGCb1utALJ6/bZVS3nt72qb8hZ3r9/0A1wIx5WMtiFAmQGwztzJIvvoRCtmgTikP1zDrk4iwAw8XWwiibg/Piej7QOw+x23qpGlwrNf61tjVuS2QkZYPppzg8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787704811; c=relaxed/simple; bh=FcFN70EMn3NFxzjIeQEMtx0bY3hAkneIIufEHZNApnw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ab4HrUGaZ+ctm6y1D7Yefu4/qfHfHShIbm1PZ1UqSIs5rp8+iVUF8huTRrtyN7qeimOOIxFCWxds5AFzzC1KxB1XssPv48kmYtH/mUBwlAcu4niYOEmEul69rOkn/7U1fyw5AjLSbCpF0lhBZvcFqcu3xQpHBy5YH5brvKU26ZA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=r1rlF2Ug; arc=none smtp.client-ip=209.85.210.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="r1rlF2Ug" Received: by mail-pf1-f171.google.com with SMTP id d2e1a72fcca58-8525efa7274so409662b3a.2 for ; Tue, 25 Aug 2026 17:40:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787704810; x=1788309610; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JuJMd61vQn7VC6GY3r3MpRqnhIXcz7QetrZGVrziers=; b=r1rlF2UgBR0VPlf9D8z36y2dw2gvX6mIMJqKfmENe0mvlHx5VdOrn3buNCnv0nwINS UTbNNh7CTkRIvbdcCQmIUHDudFmprIu8kEHFpHz0u01OXdWmqGg/w9TM2Ll9oJI3uNV9 ebgSTZzsbtxHhiCSUDazzQfOTDH32luOrtHh8/2boRNBiP3OUaKdndvEJ3FhUWe3HWYX 5pakIqd8PrQbUVxkh10hA4W9qmTRuSmhwCMyFy6IQL7Lsxq4o2K9pB0aqLdsGUK2QXB0 xv1+WRuL2xuRZBeMpm8jxI/0OM1KYOVRzfC8DQj/fVUjpAhLc2WZ3UMEu6X1wEWQ4v37 lU4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787704810; x=1788309610; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=JuJMd61vQn7VC6GY3r3MpRqnhIXcz7QetrZGVrziers=; b=b4j3fvr+EMHk32KlFSoVhFLeYxf/uTs4DETWzoAvNl3ghYsUijmRAH5O374PT/zlbE IR8UJOFn4CZujCWZb3+hZhICwJivaxezrdMmJvVS8HZatuQTtN75OVh/TwXD9uJWaBnZ HDiu/k7gw6BAqws5EjP/kVbZNv1T1GNTXgcHFiUja41q6KDeikUHDfqejQNlB+aBwZkj t95X+T9+GAjrQeI1Ok07+sZHTsDDFMwHjYdZugyE+vjw9HlZMnCBG2+wEgmCOncCslJA PuWOkHBqdSAo1YeDS1GX8KI3JX1KC5+vZYtTX+nFLR5+FJkOzK4zZUPA6s1JI+4i13PC RTDw== X-Forwarded-Encrypted: i=1; AHgh+RoMUX/vIXKcIkYcMjSW4vZGSn9V3DnOgII+3pixxw3ULfp6gsnnBRa25pRyf3jBYe6P9K4LQIRRAeJwoEU=@vger.kernel.org X-Gm-Message-State: AFuF++lM9KqXFHk0k3VNOLYXHab89N1qUJXMHnT/l6KMrGRF/tUrK6vS 5oL0den5Ju3exVTMwxi3y4W/PIKAzqiO4ysIjCUnwLDBxXCbrfQtVm8Z X-Gm-Gg: AR+sD11qsd7jsewyfIOJVgheBa0To9SydRRac+EdXssJ+zeIXAeBOO0SqvAlTQp2wYX QVXoL7x8Owf+Cd4Ldowj01gREWH0yf9cEL7SH1E5NB2VhpJDnNdC1MoY6MmXIYLuXl7Saz6/VCT Y9BtTjhvt/lMeEElwrQiSN+jinlOzKl75YiabIgrFnvX7RgPpuAEBvpnnDSoX/cfmU1nmoQRyM9 ufcp/fPkgPK3SUFfLGzeIzk5GZ/IRy/o+VfQZjtvrJIMd5Gvg00NT7uRckI18hZfW0g5JbHKLXL VdzOh1mMrekbEn5KWY3h0Ua9wgAcA5Q3CnZE3ZWgIJ79bWv9CMCb8ijzSspqEZelbZlShmfguwW yxGJK8wM8OV7y0EnccpN3gaFkcHmkTYy7JaNc1oEJfXM++zhDPqHaTCrVaH9Li40cKLeTRf6uOj boEqMqG/OqzpszexAZMR9PS+guIWVNje+WOesegrOeHRmprYc8lmVuLtwaJjWgpkf+fDrB5EzH X-Received: by 2002:a05:6a00:464e:b0:847:881c:7026 with SMTP id d2e1a72fcca58-85371baa990mr4853484b3a.3.1787704809556; Tue, 25 Aug 2026 17:40:09 -0700 (PDT) Received: from ancienth-X870E-Nova-WiFi ([125.186.72.2]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8535cdc038dsm339377b3a.38.2026.08.25.17.40.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 17:40:09 -0700 (PDT) From: Daehyeon Ko <4ncienth@gmail.com> To: netdev@vger.kernel.org Cc: sgarzare@redhat.com, stefanha@redhat.com, bobbyeshleman@gmail.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, mst@redhat.com, jasowangio@gmail.com, xuanzhuo@linux.alibaba.com, eperezma@redhat.com, bryan-bt.tan@broadcom.com, vishnu.dasa@broadcom.com, bcm-kernel-feedback-list@broadcom.com, virtualization@lists.linux.dev, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, sashiko-bot@kernel.org Subject: [PATCH net v4 2/2] vsock/vmci: validate packet source for connected sockets Date: Wed, 26 Aug 2026 09:39:28 +0900 Message-ID: <20260826003929.966160-3-4ncienth@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260826003929.966160-1-4ncienth@gmail.com> References: <20260826003929.966160-1-4ncienth@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a non-listening socket without checking whether the packet came from its stored peer. This was reproduced with two VMCI contexts. A RST from the context not stored in a TCP_SYN_SENT socket reset that socket after it was selected by the destination-only lookup. VMCI can process notification packets in bottom-half context when the socket is not owned by user context, or defer packets to a workqueue. Use vsock_check_source() after taking the socket lock in the bottom-half path, and recheck after lock_sock() in the workqueue path. Listening sockets continue to accept packets from any source. Reply with a RST addressed from the received packet before dropping a source that fails validation. This preserves the existing reset behavior for bound non-listening and concurrently closed sockets without directing the reset to a connected socket's stored peer. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Sashiko Closes: https://lore.kernel.org/netdev/20260814121255.6B5001F000E9@smtp.ker= nel.org/ Cc: stable@vger.kernel.org Suggested-by: Stefano Garzarella Suggested-by: Paolo Abeni Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> Reviewed-by: Vishnu Dasa --- net/vmw_vsock/vmci_transport.c | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c index 1c4ee039c..1f186e8f8 100644 --- a/net/vmw_vsock/vmci_transport.c +++ b/net/vmw_vsock/vmci_transport.c @@ -680,11 +680,13 @@ static int vmci_transport_recv_stream_cb(void *data, = struct vmci_datagram *dg) struct vmci_transport_packet *pkt; struct vsock_sock *vsk; bool bh_process_pkt; + bool drop_pkt; int err; =20 sk =3D NULL; err =3D VMCI_SUCCESS; bh_process_pkt =3D false; + drop_pkt =3D false; =20 /* Ignore incoming packets from resources that aren't vsock * implementations. @@ -765,17 +767,29 @@ static int vmci_transport_recv_stream_cb(void *data, = struct vmci_datagram *dg) bh_lock_sock(sk); =20 if (!sock_owned_by_user(sk)) { - /* The local context ID may be out of date, update it. */ - vsk->local_addr.svm_cid =3D dst.svm_cid; + if (sk->sk_state !=3D TCP_LISTEN && + !vsock_check_source(vsk, &vmci_transport, &src)) { + drop_pkt =3D true; + err =3D VMCI_ERROR_NO_ACCESS; + } else { + /* The local context ID may be out of date, update it. */ + vsk->local_addr.svm_cid =3D dst.svm_cid; =20 - if (sk->sk_state =3D=3D TCP_ESTABLISHED) - vmci_trans(vsk)->notify_ops->handle_notify_pkt( - sk, pkt, true, &dst, &src, - &bh_process_pkt); + if (sk->sk_state =3D=3D TCP_ESTABLISHED) + vmci_trans(vsk)->notify_ops->handle_notify_pkt(sk, pkt, true, + &dst, &src, + &bh_process_pkt); + } } =20 bh_unlock_sock(sk); =20 + if (drop_pkt) { + if (vmci_transport_send_reset_bh(&dst, &src, pkt) < 0) + pr_err("unable to send reset\n"); + goto out; + } + if (!bh_process_pkt) { struct vmci_transport_recv_pkt_info *recv_pkt_info; =20 @@ -900,6 +914,7 @@ static void vmci_transport_recv_pkt_work(struct work_st= ruct *work) { struct vmci_transport_recv_pkt_info *recv_pkt_info; struct vmci_transport_packet *pkt; + struct sockaddr_vm src; struct sock *sk; =20 recv_pkt_info =3D @@ -908,6 +923,12 @@ static void vmci_transport_recv_pkt_work(struct work_s= truct *work) pkt =3D &recv_pkt_info->pkt; =20 lock_sock(sk); + vsock_addr_init(&src, pkt->dg.src.context, pkt->src_port); + if (sk->sk_state !=3D TCP_LISTEN && + !vsock_check_source(vsock_sk(sk), &vmci_transport, &src)) { + vmci_transport_reply_reset(pkt); + goto out; + } =20 /* The local context ID may be out of date. */ vsock_sk(sk)->local_addr.svm_cid =3D pkt->dg.dst.context; @@ -937,6 +958,7 @@ static void vmci_transport_recv_pkt_work(struct work_st= ruct *work) break; } =20 +out: release_sock(sk); kfree(recv_pkt_info); /* Release reference obtained in the stream callback when we fetched