On Wed, May 15, 2024 at 11:05:43AM GMT, Michael S. Tsirkin wrote:
There are two issues around seqpacket_allow: 1. seqpacket_allow is not initialized when socket is created. Thus if features are never set, it will be read uninitialized. 2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared, then seqpacket_allow will not be cleared appropriately (existing apps I know about don't usually do this but it's legal and there's no way to be sure no one relies on this).To fix: - initialize seqpacket_allow after allocation - set it unconditionally in set_features Reported-by: syzbot+6c21aeb59d0e82eb2...@syzkaller.appspotmail.com Reported-by: Jeongjun Park <aha310...@gmail.com> Fixes: ced7b713711f ("vhost/vsock: support SEQPACKET for transport"). Cc: Arseny Krasnov <arseny.kras...@kaspersky.com> Cc: David S. Miller <da...@davemloft.net> Cc: Stefan Hajnoczi <stefa...@redhat.com> Signed-off-by: Michael S. Tsirkin <m...@redhat.com> Acked-by: Arseniy Krasnov <avkras...@salutedevices.com> Tested-by: Arseniy Krasnov <avkras...@salutedevices.com> --- Reposting now it's been tested. drivers/vhost/vsock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Thanks for fixing this issue! Reviewed-by: Stefano Garzarella <sgarz...@redhat.com>
