tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

vsock/virtio: fix potential underflow in virtio_transport_get_credit()

The credit calculation in virtio_transport_get_credit() uses unsigned
arithmetic:

ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);

If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes
are in flight, the subtraction can underflow and produce a large
positive value, potentially allowing more data to be queued than the
peer can handle.

Reuse virtio_transport_has_space() which already handles this case and
add a comment to make it clear why we are doing that.

Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko")
Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com>
[Stefano: use virtio_transport_has_space() instead of duplicating the code]
[Stefano: tweak the commit message]
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Link: https://patch.msgid.link/20260121093628.9941-2-sgarzare@redhat.com
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

authored by

Melbin K Mathew and committed by
Paolo Abeni 3ef3d52a ca1bb3fe

+9 -7
+9 -7
net/vmw_vsock/virtio_transport_common.c
··· 28 28 29 29 static void virtio_transport_cancel_close_work(struct vsock_sock *vsk, 30 30 bool cancel_timeout); 31 + static s64 virtio_transport_has_space(struct virtio_vsock_sock *vvs); 31 32 32 33 static const struct virtio_transport * 33 34 virtio_transport_get_ops(struct vsock_sock *vsk) ··· 500 499 return 0; 501 500 502 501 spin_lock_bh(&vvs->tx_lock); 503 - ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); 504 - if (ret > credit) 505 - ret = credit; 502 + ret = min_t(u32, credit, virtio_transport_has_space(vvs)); 506 503 vvs->tx_cnt += ret; 507 504 vvs->bytes_unsent += ret; 508 505 spin_unlock_bh(&vvs->tx_lock); ··· 876 877 } 877 878 EXPORT_SYMBOL_GPL(virtio_transport_seqpacket_has_data); 878 879 879 - static s64 virtio_transport_has_space(struct vsock_sock *vsk) 880 + static s64 virtio_transport_has_space(struct virtio_vsock_sock *vvs) 880 881 { 881 - struct virtio_vsock_sock *vvs = vsk->trans; 882 882 s64 bytes; 883 883 884 + /* Use s64 arithmetic so if the peer shrinks peer_buf_alloc while 885 + * we have bytes in flight (tx_cnt - peer_fwd_cnt), the subtraction 886 + * does not underflow. 887 + */ 884 888 bytes = (s64)vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); 885 889 if (bytes < 0) 886 890 bytes = 0; ··· 897 895 s64 bytes; 898 896 899 897 spin_lock_bh(&vvs->tx_lock); 900 - bytes = virtio_transport_has_space(vsk); 898 + bytes = virtio_transport_has_space(vvs); 901 899 spin_unlock_bh(&vvs->tx_lock); 902 900 903 901 return bytes; ··· 1494 1492 spin_lock_bh(&vvs->tx_lock); 1495 1493 vvs->peer_buf_alloc = le32_to_cpu(hdr->buf_alloc); 1496 1494 vvs->peer_fwd_cnt = le32_to_cpu(hdr->fwd_cnt); 1497 - space_available = virtio_transport_has_space(vsk); 1495 + space_available = virtio_transport_has_space(vvs); 1498 1496 spin_unlock_bh(&vvs->tx_lock); 1499 1497 return space_available; 1500 1498 }