lkml.org 
[lkml]   [2022]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 28/68] Fix double fget() in vhost_net_set_backend()
    Date
    From: Al Viro <viro@zeniv.linux.org.uk>

    commit fb4554c2232e44d595920f4d5c66cf8f7d13f9bc upstream.

    Descriptor table is a shared resource; two fget() on the same descriptor
    may return different struct file references. get_tap_ptr_ring() is
    called after we'd found (and pinned) the socket we'll be using and it
    tries to find the private tun/tap data structures associated with it.
    Redoing the lookup by the same file descriptor we'd used to get the
    socket is racy - we need to same struct file.

    Thanks to Jason for spotting a braino in the original variant of patch -
    I'd missed the use of fd == -1 for disabling backend, and in that case
    we can end up with sock == NULL and sock != oldsock.

    Cc: stable@kernel.org
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/vhost/net.c | 15 +++++++--------
    1 file changed, 7 insertions(+), 8 deletions(-)

    --- a/drivers/vhost/net.c
    +++ b/drivers/vhost/net.c
    @@ -1446,13 +1446,9 @@ err:
    return ERR_PTR(r);
    }

    -static struct ptr_ring *get_tap_ptr_ring(int fd)
    +static struct ptr_ring *get_tap_ptr_ring(struct file *file)
    {
    struct ptr_ring *ring;
    - struct file *file = fget(fd);
    -
    - if (!file)
    - return NULL;
    ring = tun_get_tx_ring(file);
    if (!IS_ERR(ring))
    goto out;
    @@ -1461,7 +1457,6 @@ static struct ptr_ring *get_tap_ptr_ring
    goto out;
    ring = NULL;
    out:
    - fput(file);
    return ring;
    }

    @@ -1548,8 +1543,12 @@ static long vhost_net_set_backend(struct
    r = vhost_net_enable_vq(n, vq);
    if (r)
    goto err_used;
    - if (index == VHOST_NET_VQ_RX)
    - nvq->rx_ring = get_tap_ptr_ring(fd);
    + if (index == VHOST_NET_VQ_RX) {
    + if (sock)
    + nvq->rx_ring = get_tap_ptr_ring(sock->file);
    + else
    + nvq->rx_ring = NULL;
    + }

    oldubufs = nvq->ubufs;
    nvq->ubufs = ubufs;

    \
     
     \ /
      Last update: 2022-05-23 20:14    [W:8.155 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site