]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
vsock/loopback: use only sk_buff_head.lock to protect the packet queue
authorStefano Garzarella <sgarzare@redhat.com>
Fri, 24 Mar 2023 11:54:50 +0000 (12:54 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 20 Nov 2023 10:52:19 +0000 (11:52 +0100)
commitbb1c9a5907d25742c0285e9d7fa518b9f237c944
tree21b6fddf2581ae94a9116b0d2641f31116da1705
parent1e5f00e9dbdbf6f78adc0fe658b6ac54df71d452
vsock/loopback: use only sk_buff_head.lock to protect the packet queue

commit b465518dc27da1ed74b8cbada4659708aac35adb upstream.

pkt_list_lock was used before commit 71dc9ec9ac7d ("virtio/vsock:
replace virtio_vsock_pkt with sk_buff") to protect the packet queue.
After that commit we switched to sk_buff and we are using
sk_buff_head.lock in almost every place to protect the packet queue
except in vsock_loopback_work() when we call skb_queue_splice_init().

As reported by syzbot, this caused unlocked concurrent access to the
packet queue between vsock_loopback_work() and
vsock_loopback_cancel_pkt() since it is not holding pkt_list_lock.

With the introduction of sk_buff_head, pkt_list_lock is redundant and
can cause confusion, so let's remove it and use sk_buff_head.lock
everywhere to protect the packet queue access.

Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
Cc: bobby.eshleman@bytedance.com
Reported-and-tested-by: syzbot+befff0a9536049e7902e@syzkaller.appspotmail.com
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Bobby Eshleman <bobby.eshleman@bytedance.com>
Reviewed-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/vmw_vsock/vsock_loopback.c