vsock: fix recursive ->recvmsg calls

After a vsock socket has been added to a BPF sockmap, its prot->recvmsg
has been replaced with vsock_bpf_recvmsg(). Thus the following
recursiion could happen:

vsock_bpf_recvmsg()
 -> __vsock_recvmsg()
  -> vsock_connectible_recvmsg()
   -> prot->recvmsg()
    -> vsock_bpf_recvmsg() again

We need to fix it by calling the original ->recvmsg() without any BPF
sockmap logic in __vsock_recvmsg().

Fixes: 634f1a7110b4 ("vsock: support sockmap")
Reported-by: syzbot+bdb4bd87b5e22058e2a4@syzkaller.appspotmail.com
Tested-by: syzbot+bdb4bd87b5e22058e2a4@syzkaller.appspotmail.com
Cc: Bobby Eshleman <bobby.eshleman@bytedance.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20240812022153.86512-1-xiyou.wangcong@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
index 535701efc1e5cec874b8b94088020b1199c8b8c0..24d970f7a4fa22d289e07c1bbaa0dd8bc7b972bb 100644 (file)
--- a/include/net/af_vsock.h
+++ b/include/net/af_vsock.h
@@ -230,8 +230,12 @@ struct vsock_tap {
 int vsock_add_tap(struct vsock_tap *vt);
 int vsock_remove_tap(struct vsock_tap *vt);
 void vsock_deliver_tap(struct sk_buff *build_skb(void *opaque), void *opaque);
+int __vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+                               int flags);
 int vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                              int flags);
+int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
+                         size_t len, int flags);
 int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
                        size_t len, int flags);
 

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 4b040285aa78c061d636e1a0a75a59fbe931333b..0ff9b2dd86bac261fe3d787e0f94eaa3a0c456c9 100644 (file)
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1270,25 +1270,28 @@ out:
        return err;
 }
 
+int __vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
+                         size_t len, int flags)
+{
+       struct sock *sk = sock->sk;
+       struct vsock_sock *vsk = vsock_sk(sk);
+
+       return vsk->transport->dgram_dequeue(vsk, msg, len, flags);
+}
+
 int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
                        size_t len, int flags)
 {
 #ifdef CONFIG_BPF_SYSCALL
+       struct sock *sk = sock->sk;
        const struct proto *prot;
-#endif
-       struct vsock_sock *vsk;
-       struct sock *sk;
 
-       sk = sock->sk;
-       vsk = vsock_sk(sk);
-
-#ifdef CONFIG_BPF_SYSCALL
        prot = READ_ONCE(sk->sk_prot);
        if (prot != &vsock_proto)
                return prot->recvmsg(sk, msg, len, flags, NULL);
 #endif
 
-       return vsk->transport->dgram_dequeue(vsk, msg, len, flags);
+       return __vsock_dgram_recvmsg(sock, msg, len, flags);
 }
 EXPORT_SYMBOL_GPL(vsock_dgram_recvmsg);
 
@@ -2174,15 +2177,12 @@ out:
 }
 
 int
-vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
-                         int flags)
+__vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+                           int flags)
 {
        struct sock *sk;
        struct vsock_sock *vsk;
        const struct vsock_transport *transport;
-#ifdef CONFIG_BPF_SYSCALL
-       const struct proto *prot;
-#endif
        int err;
 
        sk = sock->sk;
@@ -2233,14 +2233,6 @@ vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                goto out;
        }
 
-#ifdef CONFIG_BPF_SYSCALL
-       prot = READ_ONCE(sk->sk_prot);
-       if (prot != &vsock_proto) {
-               release_sock(sk);
-               return prot->recvmsg(sk, msg, len, flags, NULL);
-       }
-#endif
-
        if (sk->sk_type == SOCK_STREAM)
                err = __vsock_stream_recvmsg(sk, msg, len, flags);
        else
@@ -2250,6 +2242,22 @@ out:
        release_sock(sk);
        return err;
 }
+
+int
+vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+                         int flags)
+{
+#ifdef CONFIG_BPF_SYSCALL
+       struct sock *sk = sock->sk;
+       const struct proto *prot;
+
+       prot = READ_ONCE(sk->sk_prot);
+       if (prot != &vsock_proto)
+               return prot->recvmsg(sk, msg, len, flags, NULL);
+#endif
+
+       return __vsock_connectible_recvmsg(sock, msg, len, flags);
+}
 EXPORT_SYMBOL_GPL(vsock_connectible_recvmsg);
 
 static int vsock_set_rcvlowat(struct sock *sk, int val)

diff --git a/net/vmw_vsock/vsock_bpf.c b/net/vmw_vsock/vsock_bpf.c
index a3c97546ab84a620263ed17fafaf94910d416f07..c42c5cc18f324108e044772e957c8d42c92ead8c 100644 (file)
--- a/net/vmw_vsock/vsock_bpf.c
+++ b/net/vmw_vsock/vsock_bpf.c
@@ -64,9 +64,9 @@ static int __vsock_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int
        int err;
 
        if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)
-               err = vsock_connectible_recvmsg(sock, msg, len, flags);
+               err = __vsock_connectible_recvmsg(sock, msg, len, flags);
        else if (sk->sk_type == SOCK_DGRAM)
-               err = vsock_dgram_recvmsg(sock, msg, len, flags);
+               err = __vsock_dgram_recvmsg(sock, msg, len, flags);
        else
                err = -EPROTOTYPE;