• Stefan Hajnoczi's avatar
    vhost/vsock: fix use-after-free in network stack callers · 834e772c
    Stefan Hajnoczi authored
    If the network stack calls .send_pkt()/.cancel_pkt() during .release(),
    a struct vhost_vsock use-after-free is possible.  This occurs because
    .release() does not wait for other CPUs to stop using struct
    vhost_vsock.
    
    Switch to an RCU-enabled hashtable (indexed by guest CID) so that
    .release() can wait for other CPUs by calling synchronize_rcu().  This
    also eliminates vhost_vsock_lock acquisition in the data path so it
    could have a positive effect on performance.
    
    This is CVE-2018-14625 "kernel: use-after-free Read in vhost_transport_send_pkt".
    
    Cc: stable@vger.kernel.org
    Reported-and-tested-by: syzbot+bd391451452fb0b93039@syzkaller.appspotmail.com
    Reported-by: syzbot+e3e074963495f92a89ed@syzkaller.appspotmail.com
    Reported-by: syzbot+d5a0a170c5069658b141@syzkaller.appspotmail.com
    Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    Acked-by: default avatarJason Wang <jasowang@redhat.com>
    834e772c
vsock.c 19.5 KB