From: Greg Kroah-Hartman Date: Fri, 15 May 2026 15:14:54 +0000 (+0200) Subject: 6.1-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a12428f4e2ed617d24ace9be5d55ee1dcfe4fd33;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: vsock-fix-buffer-size-clamping-order.patch vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch --- diff --git a/queue-6.1/series b/queue-6.1/series index 012b946040..30bd2e055b 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -424,3 +424,5 @@ bluetooth-l2cap-fix-null-ptr-deref-in-l2cap_sock_get_sndtimeo_cb.patch mtd-spi-nor-sst-factor-out-common-write-operation-to-sst_nor_write_data.patch mtd-spi-nor-sst-fix-write-enable-before-aai-sequence.patch pwm-imx-tpm-count-the-number-of-enabled-channels-in-probe.patch +vsock-fix-buffer-size-clamping-order.patch +vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch diff --git a/queue-6.1/vsock-fix-buffer-size-clamping-order.patch b/queue-6.1/vsock-fix-buffer-size-clamping-order.patch new file mode 100644 index 0000000000..4dae0a3f16 --- /dev/null +++ b/queue-6.1/vsock-fix-buffer-size-clamping-order.patch @@ -0,0 +1,50 @@ +From d114bfdc9b76bf93b881e195b7ec957c14227bab Mon Sep 17 00:00:00 2001 +From: Norbert Szetei +Date: Thu, 9 Apr 2026 18:34:12 +0200 +Subject: vsock: fix buffer size clamping order + +From: Norbert Szetei + +commit d114bfdc9b76bf93b881e195b7ec957c14227bab upstream. + +In vsock_update_buffer_size(), the buffer size was being clamped to the +maximum first, and then to the minimum. If a user sets a minimum buffer +size larger than the maximum, the minimum check overrides the maximum +check, inverting the constraint. + +This breaks the intended socket memory boundaries by allowing the +vsk->buffer_size to grow beyond the configured vsk->buffer_max_size. + +Fix this by checking the minimum first, and then the maximum. This +ensures the buffer size never exceeds the buffer_max_size. + +Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core") +Suggested-by: Stefano Garzarella +Signed-off-by: Norbert Szetei +Reviewed-by: Stefano Garzarella +Link: https://patch.msgid.link/180118C5-8BCF-4A63-A305-4EE53A34AB9C@doyensec.com +Signed-off-by: Jakub Kicinski +Cc: Luigi Leonardi +Signed-off-by: Greg Kroah-Hartman +--- + net/vmw_vsock/af_vsock.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1680,12 +1680,12 @@ static void vsock_update_buffer_size(str + const struct vsock_transport *transport, + u64 val) + { +- if (val > vsk->buffer_max_size) +- val = vsk->buffer_max_size; +- + if (val < vsk->buffer_min_size) + val = vsk->buffer_min_size; + ++ if (val > vsk->buffer_max_size) ++ val = vsk->buffer_max_size; ++ + if (val != vsk->buffer_size && + transport && transport->notify_buffer_size) + transport->notify_buffer_size(vsk, &val); diff --git a/queue-6.1/vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch b/queue-6.1/vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch new file mode 100644 index 0000000000..378a63b910 --- /dev/null +++ b/queue-6.1/vsock-virtio-fix-accept-queue-count-leak-on-transport-mismatch.patch @@ -0,0 +1,54 @@ +From 52bcb57a4e8a0865a76c587c2451906342ae1b2d Mon Sep 17 00:00:00 2001 +From: Dudu Lu +Date: Mon, 13 Apr 2026 21:14:09 +0800 +Subject: vsock/virtio: fix accept queue count leak on transport mismatch + +From: Dudu Lu + +commit 52bcb57a4e8a0865a76c587c2451906342ae1b2d upstream. + +virtio_transport_recv_listen() calls sk_acceptq_added() before +vsock_assign_transport(). If vsock_assign_transport() fails or +selects a different transport, the error path returns without +calling sk_acceptq_removed(), permanently incrementing +sk_ack_backlog. + +After approximately backlog+1 such failures, sk_acceptq_is_full() +returns true, causing the listener to reject all new connections. + +Fix by moving sk_acceptq_added() to after the transport validation, +matching the pattern used by vmci_transport and hyperv_transport. + +Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") +Signed-off-by: Dudu Lu +Reviewed-by: Bobby Eshleman +Reviewed-by: Luigi Leonardi +Reviewed-by: Stefano Garzarella +Acked-by: Michael S. Tsirkin +Link: https://patch.msgid.link/20260413131409.19022-1-phx0fer@gmail.com +Signed-off-by: Paolo Abeni +Cc: Luigi Leonardi +Signed-off-by: Greg Kroah-Hartman +--- + net/vmw_vsock/virtio_transport_common.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -1259,8 +1259,6 @@ virtio_transport_recv_listen(struct sock + return -ENOMEM; + } + +- sk_acceptq_added(sk); +- + lock_sock_nested(child, SINGLE_DEPTH_NESTING); + + child->sk_state = TCP_ESTABLISHED; +@@ -1282,6 +1280,7 @@ virtio_transport_recv_listen(struct sock + return ret; + } + ++ sk_acceptq_added(sk); + if (virtio_transport_space_update(child, skb)) + child->sk_write_space(child); +