vmci_transport_allow_dgram() cached its result in vsock->cached_peer and
vsock->cached_peer_allow_dgram with an unsynchronized check-then-set. The
function runs both in the lockless receive tasklet
(vmci_transport_recv_dgram_cb(), no socket lock) and in the lock_sock() send
path; lock_sock() does not exclude bottom halves, so the two contexts race on
those fields and can return a stale 'allow' for a VMCI_PRIVILEGE_FLAG_RESTRICTED
peer. It is also a plain data race. The in-code comment claiming the fields
are never modified outside create/destruct is contradicted by the send path.
Keep the O(1) cache -- it avoids an O(N) vmci_ctx_get() lookup on every
datagram in the bottom-half receive path -- but pack the peer CID and the
decision into a single word accessed with READ_ONCE()/WRITE_ONCE(). A race
then only forces a recompute and can never return a stale allow.
This was found by code inspection; I do not have VMCI hardware to test on
(compile-tested only).
Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: Bartłomiej Dmitruk <[email protected]>
Assisted-by: Claude (Anthropic)
---
v2: keep an O(1) cache made race-safe rather than dropping it entirely; an
earlier revision removed the cache, which the Sashiko AI review flagged as
an O(N)-per-datagram fast-path regression. Split out per Stefano
Garzarella; independent of namespace support.
v1:
https://lore.kernel.org/netdev/[email protected]/
diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
index 5549298c1..97968ac53 100644
--- a/include/net/af_vsock.h
+++ b/include/net/af_vsock.h
@@ -39,10 +39,13 @@ struct vsock_sock {
* modified outsided of socket create or destruct.
*/
bool trusted;
- bool cached_peer_allow_dgram; /* Dgram communication allowed to
- * cached peer?
- */
- u32 cached_peer; /* Context ID of last dgram destination check. */
+ /* Cached dgram access decision for the last peer, packed as
+ * (cid << 32) | VALID | ALLOW and accessed via READ_ONCE()/
+ * WRITE_ONCE() so the lockless receive tasklet and the
+ * lock_sock() send path cannot race to a stale decision.
+ * See vmci_transport_allow_dgram().
+ */
+ u64 cached_peer_access;
const struct cred *owner;
/* Rest are SOCK_STREAM only. */
long connect_timeout;
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -524,23 +524,38 @@
* only if it is trusted as described in vmci_transport_is_trusted.
*/
+/* Packing for vsk->cached_peer_access. */
+#define VMCI_DGRAM_ACCESS_VALID BIT_ULL(0)
+#define VMCI_DGRAM_ACCESS_ALLOW BIT_ULL(1)
+#define VMCI_DGRAM_ACCESS_CID_SHIFT 32
+
static bool vmci_transport_allow_dgram(struct vsock_sock *vsock, u32 peer_cid)
{
+ u64 access;
+
if (VMADDR_CID_HYPERVISOR == peer_cid)
return true;
- if (vsock->cached_peer != peer_cid) {
- vsock->cached_peer = peer_cid;
- if (!vmci_transport_is_trusted(vsock, peer_cid) &&
- (vmci_context_get_priv_flags(peer_cid) &
- VMCI_PRIVILEGE_FLAG_RESTRICTED)) {
- vsock->cached_peer_allow_dgram = false;
- } else {
- vsock->cached_peer_allow_dgram = true;
- }
- }
+ /* Cache the trusted/restricted decision for the last peer to avoid the
+ * O(N) vmci_ctx_get() lookup on every datagram. Read/update it through
+ * a single word so a race between the lockless receive tasklet and the
+ * lock_sock() send path only forces a recompute -- it can never return
a
+ * stale allow for a restricted peer.
+ */
+ access = READ_ONCE(vsock->cached_peer_access);
+ if ((access & VMCI_DGRAM_ACCESS_VALID) &&
+ (u32)(access >> VMCI_DGRAM_ACCESS_CID_SHIFT) == peer_cid)
+ return !!(access & VMCI_DGRAM_ACCESS_ALLOW);
- return vsock->cached_peer_allow_dgram;
+ access = VMCI_DGRAM_ACCESS_VALID |
+ ((u64)peer_cid << VMCI_DGRAM_ACCESS_CID_SHIFT);
+ if (vmci_transport_is_trusted(vsock, peer_cid) ||
+ !(vmci_context_get_priv_flags(peer_cid) &
+ VMCI_PRIVILEGE_FLAG_RESTRICTED))
+ access |= VMCI_DGRAM_ACCESS_ALLOW;
+
+ WRITE_ONCE(vsock->cached_peer_access, access);
+ return !!(access & VMCI_DGRAM_ACCESS_ALLOW);
}
static int
