transport_{h2g,g2h,dgram,local} may become NULL on vsock_core_unregister().
Make sure a poorly timed `rmmod transport` won't lead to a NULL/stale
pointer dereference.Note that these oopses are pretty unlikely to happen in the wild. Splats were collected after sprinkling kernel with mdelay()s. Signed-off-by: Michal Luczaj <[email protected]> --- Changes in v3: - Static transport_* CID getter rename and comment [Stefano] - Link to v2: https://lore.kernel.org/r/[email protected] Changes in v2: - Introduce a helper function to get local CIDs safely [Stefano] - Rename goto label to indicate an error path, explain why releasing vsock_register_mutex after try_module_get() is safe [Stefano] - Link to v1: https://lore.kernel.org/r/[email protected] --- Michal Luczaj (3): vsock: Fix transport_{g2h,h2g} TOCTOU vsock: Fix transport_* TOCTOU vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local` net/vmw_vsock/af_vsock.c | 57 ++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 46 insertions(+), 11 deletions(-) --- base-commit: 561aa0e22b70a5e7246b73d62a824b3aef3fc375 change-id: 20250523-vsock-transports-toctou-4b75d9c2a805 Best regards, -- Michal Luczaj <[email protected]>
