On Mon, 24 Aug 2026 17:12:57 +0800 Rongguang Wei <[email protected]> wrote:
> From: Rongguang Wei <[email protected]> > > SO_VM_SOCKETS_BUFFER_MIN_SIZE and SO_VM_SOCKETS_BUFFER_MAX_SIZE > do not cross-validate against each other, allowing userspace to > set buffer_min_size > buffer_max_size. > When min > max, buffer_size is silently clamped to an incorrect > value. For example, setting min=512KB then max=128 results in > buffer_size=128 despite the user requesting much larger buffers > via SO_VM_SOCKETS_BUFFER_SIZE. > > Reproduced with a test program: > setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MIN_SIZE, > 512 * 1024, sizeof(int)); > setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MAX_SIZE, > 128, sizeof(int)); > // User asked for 1MB but got 128 bytes silently > setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_SIZE, > 1024 * 1024, sizeof(int)); > > After that use getsockopt to get the buffer_size = 128 and > buffer_min_size = 524288, buffer_max_size = 128. > The buffer_min_size > buffer_max_size and the kernel accepted > contradictory values without error. > > Add value check to fix this issue. Return -EINVAL to userspace > when setting MAX_SIZE to a value smaller than the current MIN_SIZE > or setting MIN_SIZE to a value larger than the current MAX_SIZE. That is going to break userspace that sets the minimum before the maximum when the new minimum is larger than the old maximum. David > > Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core") > Signed-off-by: Rongguang Wei <[email protected]> > --- > net/vmw_vsock/af_vsock.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c > index a33b2a2d381d..5faa30ee8745 100644 > --- a/net/vmw_vsock/af_vsock.c > +++ b/net/vmw_vsock/af_vsock.c > @@ -2050,12 +2050,20 @@ static int vsock_connectible_setsockopt(struct socket > *sock, > > case SO_VM_SOCKETS_BUFFER_MAX_SIZE: > COPY_IN(val); > + if (val < vsk->buffer_min_size) { > + err = -EINVAL; > + goto exit; > + } > vsk->buffer_max_size = val; > vsock_update_buffer_size(vsk, transport, vsk->buffer_size); > break; > > case SO_VM_SOCKETS_BUFFER_MIN_SIZE: > COPY_IN(val); > + if (val > vsk->buffer_max_size) { > + err = -EINVAL; > + goto exit; > + } > vsk->buffer_min_size = val; > vsock_update_buffer_size(vsk, transport, vsk->buffer_size); > break;
