hvs_open_connection() only checks sk->sk_state (TCP_LISTEN for a
host-initiated connection, TCP_SYN_SENT for a guest-initiated one) before
proceeding. __vsock_release() sets sk->sk_shutdown = SHUTDOWN_MASK and, for
a listener, flushes the accept queue, while leaving sk_state unchanged. A
VMBUS channel offer that races close() therefore still passes the state
check and either enqueues a child onto the already-flushed accept queue
(conn_from_host) or completes a connection on a socket being torn down
(!conn_from_host); the socket and its VMBUS channel then leak.
The virtio transport guards the listener case in
virtio_transport_recv_listen(); hv_sock has no equivalent. Add a
sk_shutdown == SHUTDOWN_MASK check to the common path right after
lock_sock(), so both the host- and guest-initiated paths bail out.
hv_sock holds lock_sock(sk) across hvs_open_connection(), so the check is
race-free.
This was found by code inspection; I do not have Hyper-V hardware to test on.
Fixes: ae0078fcf0a5 ("hv_sock: implements Hyper-V transport for Virtual Sockets
(AF_VSOCK)")
Signed-off-by: Bartłomiej Dmitruk <[email protected]>
---
v2: move the SHUTDOWN_MASK check to the common checks after lock_sock() so it
also covers the guest-initiated (!conn_from_host) path; add Fixes tag
(Stefano Garzarella).
v1:
https://lore.kernel.org/netdev/[email protected]/
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -322,6 +322,15 @@
(!conn_from_host && sk->sk_state != TCP_SYN_SENT))
goto out;
+ /* __vsock_release() may have already set sk_shutdown = SHUTDOWN_MASK
+ * (and, for a listener, flushed the accept queue) while leaving the
+ * socket in TCP_LISTEN/TCP_SYN_SENT. Proceeding would enqueue a child
+ * onto a released listener, or complete a connection on a released
+ * socket, leaking it and its VMBUS channel.
+ */
+ if (sk->sk_shutdown == SHUTDOWN_MASK)
+ goto out;
+
if (conn_from_host) {
if (sk_acceptq_is_full(sk))
goto out;
