| Message ID | 20250204-vsock-linger-nullderef-v1-0-6eb1760fa93e@rbox.co (mailing list archive) |
|---|---|
| Headers | show |
| Series | vsock: null-ptr-deref when SO_LINGER enabled | expand |
On Tue, Feb 04, 2025 at 01:29:51AM +0100, Michal Luczaj wrote: >syzbot pointed out that a recent patching of a use-after-free introduced a >null-ptr-deref. This series fixes the problem and adds a test. > >Fixes fcdd2242c023 ("vsock: Keep the binding until socket destruction"). > >Signed-off-by: Michal Luczaj <mhal@rbox.co> >--- >Michal Luczaj (2): > vsock: Orphan socket after transport release > vsock/test: Add test for SO_LINGER null ptr deref > > net/vmw_vsock/af_vsock.c | 3 ++- > tools/testing/vsock/vsock_test.c | 41 ++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 43 insertions(+), 1 deletion(-) >--- >base-commit: 0e6dc66b5c5fa186a9f96c66421af74212ebcf66 >change-id: 20250203-vsock-linger-nullderef-cbe4402ad306 > >Best regards, >-- >Michal Luczaj <mhal@rbox.co> > I ran the vsock test suite and the reproducer with and without the fix in place. Thanks, Luigi Tested-by: Luigi Leonardi <leonardi@redhat.com>
syzbot pointed out that a recent patching of a use-after-free introduced a null-ptr-deref. This series fixes the problem and adds a test. Fixes fcdd2242c023 ("vsock: Keep the binding until socket destruction"). Signed-off-by: Michal Luczaj <mhal@rbox.co> --- Michal Luczaj (2): vsock: Orphan socket after transport release vsock/test: Add test for SO_LINGER null ptr deref net/vmw_vsock/af_vsock.c | 3 ++- tools/testing/vsock/vsock_test.c | 41 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 1 deletion(-) --- base-commit: 0e6dc66b5c5fa186a9f96c66421af74212ebcf66 change-id: 20250203-vsock-linger-nullderef-cbe4402ad306 Best regards,