From: Rongguang Wei <[email protected]>
SO_VM_SOCKETS_BUFFER_MIN_SIZE and SO_VM_SOCKETS_BUFFER_MAX_SIZE
do not cross-validate against each other, allowing userspace to
set buffer_min_size > buffer_max_size.
When min > max, buffer_size is silently clamped to an incorrect
value. For example, setting min=512KB then max=128 results in
buffer_size=128 despite the user requesting much larger buffers
via SO_VM_SOCKETS_BUFFER_SIZE.
Reproduced with a test program:
setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MIN_SIZE,
512 * 1024, sizeof(int));
setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MAX_SIZE,
128, sizeof(int));
// User asked for 1MB but got 128 bytes silently
setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_SIZE,
1024 * 1024, sizeof(int));
After that use getsockopt to get the buffer_size = 128 and
buffer_min_size = 524288, buffer_max_size = 128.
The buffer_min_size > buffer_max_size and the kernel accepted
contradictory values without error.
Add value check to fix this issue. Return -EINVAL to userspace
when setting MAX_SIZE to a value smaller than the current MIN_SIZE
or setting MIN_SIZE to a value larger than the current MAX_SIZE.
Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core")
Signed-off-by: Rongguang Wei <[email protected]>
---
net/vmw_vsock/af_vsock.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index a33b2a2d381d..5faa30ee8745 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -2050,12 +2050,20 @@ static int vsock_connectible_setsockopt(struct socket
*sock,
case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
COPY_IN(val);
+ if (val < vsk->buffer_min_size) {
+ err = -EINVAL;
+ goto exit;
+ }
vsk->buffer_max_size = val;
vsock_update_buffer_size(vsk, transport, vsk->buffer_size);
break;
case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
COPY_IN(val);
+ if (val > vsk->buffer_max_size) {
+ err = -EINVAL;
+ goto exit;
+ }
vsk->buffer_min_size = val;
vsock_update_buffer_size(vsk, transport, vsk->buffer_size);
break;
--
2.25.1
No virus found
Checked by Hillstone Network AntiVirus
