]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
vsock: fix buffer size clamping order
authorNorbert Szetei <norbert@doyensec.com>
Thu, 9 Apr 2026 16:34:12 +0000 (18:34 +0200)
committerJakub Kicinski <kuba@kernel.org>
Sun, 12 Apr 2026 21:31:50 +0000 (14:31 -0700)
commitd114bfdc9b76bf93b881e195b7ec957c14227bab
tree82c351cfa07261287e534504d91d17310a4c68ea
parent6f533abe7bbad2eef1e42c639b6bb9dad2b02362
vsock: fix buffer size clamping order

In vsock_update_buffer_size(), the buffer size was being clamped to the
maximum first, and then to the minimum. If a user sets a minimum buffer
size larger than the maximum, the minimum check overrides the maximum
check, inverting the constraint.

This breaks the intended socket memory boundaries by allowing the
vsk->buffer_size to grow beyond the configured vsk->buffer_max_size.

Fix this by checking the minimum first, and then the maximum. This
ensures the buffer size never exceeds the buffer_max_size.

Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core")
Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/180118C5-8BCF-4A63-A305-4EE53A34AB9C@doyensec.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/vmw_vsock/af_vsock.c