kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net/vmw_vsock
History
Stefano Garzarella 09bba278cc vsock: fix lock inversion in vsock_assign_transport() 
commit f7c877e753 upstream.

Syzbot reported a potential lock inversion deadlock between
vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.

The issue was introduced by commit 687aa0c558 ("vsock: Fix
transport_* TOCTOU") which added vsock_register_mutex locking in
vsock_assign_transport() around the transport->release() call, that can
call vsock_linger(). vsock_assign_transport() can be called with sk_lock
held. vsock_linger() calls sk_wait_event() that temporarily releases and
re-acquires sk_lock. During this window, if another thread hold
vsock_register_mutex while trying to acquire sk_lock, a circular
dependency is created.

Fix this by releasing vsock_register_mutex before calling
transport->release() and vsock_deassign_transport(). This is safe
because we don't need to hold vsock_register_mutex while releasing the
old transport, and we ensure the new transport won't disappear by
obtaining a module reference first via try_module_get().

Reported-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com
Tested-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com
Fixes: 687aa0c558 ("vsock: Fix transport_* TOCTOU")
Cc: mhal@rbox.co
Cc: stable@vger.kernel.org
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20251021121718.137668-1-sgarzare@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-29 14:03:12 +01:00
..
af_vsock.c vsock: fix lock inversion in vsock_assign_transport() 2025-10-29 14:03:12 +01:00
af_vsock_tap.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
diag.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321 2019-06-05 17:37:05 +02:00
hyperv_transport.c hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer 2024-11-14 13:13:42 +01:00
Kconfig vsock: add vsock_loopback transport 2019-12-11 15:01:23 -08:00
Makefile vsock: add vsock_loopback transport 2019-12-11 15:01:23 -08:00
virtio_transport.c vsock/virtio: initialize the_virtio_vsock before using VQs 2023-11-08 17:26:37 +01:00
virtio_transport_common.c vsock/virtio: discard packets if the transport changes 2025-01-23 17:16:03 +01:00
vmci_transport.c vsock/vmci: Clear the vmci transport packet properly when initializing it 2025-07-10 15:57:42 +02:00
vmci_transport.h vsock: handle buffer_size sockopts in the core 2019-11-14 18:12:18 -08:00
vmci_transport_notify.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321 2019-06-05 17:37:05 +02:00
vmci_transport_notify.h vsock: remove include/linux/vm_sockets.h file 2019-11-14 18:12:17 -08:00
vmci_transport_notify_qstate.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 321 2019-06-05 17:37:05 +02:00
vsock_addr.c vsock_addr: Check for supported flag values 2020-12-14 19:33:39 -08:00
vsock_loopback.c vsock/loopback: enable SEQPACKET for transport 2021-06-11 13:32:47 -07:00