From patchwork Mon Feb 21 11:49:16 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Garzarella X-Patchwork-Id: 12753506 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C545C433EF for ; Mon, 21 Feb 2022 11:49:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235979AbiBULtr (ORCPT ); Mon, 21 Feb 2022 06:49:47 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:44774 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231810AbiBULtp (ORCPT ); Mon, 21 Feb 2022 06:49:45 -0500 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 3F0C31EEE8 for ; Mon, 21 Feb 2022 03:49:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1645444161; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=12CjzIfm9u48VcTin9bYn/mbYSt9Byr6lQhm+jL2Tdg=; b=ghOanVcIIx1ygXHpL+lBeLbLRsEqPrrhybxOerlaygsFE7K7D64LfQTQYsj6ZImacVYL48 CByO/0JDZjxim7GudoDBmOu1Ue3adE97t5jCFzOTdwLaUUL6Yyefdf6H5QgFi4/HxsfKJR i4r/wwgdIOMT3i7bJVwYzNTWUHspEfc= Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-257-aAXovElGOlWlRpU29zOCeA-1; Mon, 21 Feb 2022 06:49:20 -0500 X-MC-Unique: aAXovElGOlWlRpU29zOCeA-1 Received: by mail-wr1-f70.google.com with SMTP id s22-20020adf9796000000b001e7e75ab581so7242925wrb.23 for ; Mon, 21 Feb 2022 03:49:19 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=12CjzIfm9u48VcTin9bYn/mbYSt9Byr6lQhm+jL2Tdg=; b=KV8F29H190fLKxAT1R69DUVOg79KrAstdK+4//9t6BygemW1FzgF46+sHrS3yjyuAw GyEbhondi9y+cRIYFCepIQRzVGGsmzVaM0SA3ZWGaX/jNeXtnp67vn3GKR6YfZE+snz9 UYMkbHSxoQLce/K+gD3UIIqIvLGM7VvNXr6IaI7sPv3ov95tVSeERdDZPxJljBMihhkW FGN/ZN6uLVLQkKhlG6hYRUFBa/VjKbcW4E9MYd48QCOZgh2QubmFeskGNPLmmrTmKMmj 6DMi1LfAYjuIAjZhc4eRtRH1qxk4EmmGdhERV7fPk2InprjLwB48EI8oDJI+wRbBMFgf wbsA== X-Gm-Message-State: AOAM532Sm/wEAdsCFF4JO1RkrDDD5g8rEE+rw7Mt/NVSnNFFaOQt1zDF /H62pw78hfmMMQN9GXJYGBdAw5MB4Co+VvSfx3/f/KRdVGaN4nvRPgoDdVyFvrcLJWSiy7XRtc7 eRGFA8KKC3WbT X-Received: by 2002:a7b:c844:0:b0:37b:b986:7726 with SMTP id c4-20020a7bc844000000b0037bb9867726mr17401387wml.160.1645444158956; Mon, 21 Feb 2022 03:49:18 -0800 (PST) X-Google-Smtp-Source: ABdhPJz80NBK4xySdNK92dBVDo686zdoILiLjZ8DrwJxbn6DUuDBzdF93Cfrshx7zCott46Y92HTgQ== X-Received: by 2002:a7b:c844:0:b0:37b:b986:7726 with SMTP id c4-20020a7bc844000000b0037bb9867726mr17401363wml.160.1645444158689; Mon, 21 Feb 2022 03:49:18 -0800 (PST) Received: from step1.redhat.com (host-95-248-229-156.retail.telecomitalia.it. [95.248.229.156]) by smtp.gmail.com with ESMTPSA id o6-20020a05600c338600b0037c322d1425sm7141176wmp.8.2022.02.21.03.49.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Feb 2022 03:49:17 -0800 (PST) From: Stefano Garzarella To: "Michael S. Tsirkin" Cc: linux-kernel@vger.kernel.org, Mike Christie , Stefano Garzarella , Jason Wang , netdev@vger.kernel.org, Asias He , virtualization@lists.linux-foundation.org, Stefan Hajnoczi , kvm@vger.kernel.org Subject: [PATCH] vhost/vsock: don't check owner in vhost_vsock_stop() while releasing Date: Mon, 21 Feb 2022 12:49:16 +0100 Message-Id: <20220221114916.107045-1-sgarzare@redhat.com> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org vhost_vsock_stop() calls vhost_dev_check_owner() to check the device ownership. It expects current->mm to be valid. vhost_vsock_stop() is also called by vhost_vsock_dev_release() when the user has not done close(), so when we are in do_exit(). In this case current->mm is invalid and we're releasing the device, so we should clean it anyway. Let's check the owner only when vhost_vsock_stop() is called by an ioctl. Fixes: 433fc58e6bf2 ("VSOCK: Introduce vhost_vsock.ko") Cc: stable@vger.kernel.org Reported-by: syzbot+1e3ea63db39f2b4440e0@syzkaller.appspotmail.com Signed-off-by: Stefano Garzarella Reported-by: kernel test robot Reported-by: Dan Carpenter --- drivers/vhost/vsock.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index d6ca1c7ad513..f00d2dfd72b7 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -629,16 +629,18 @@ static int vhost_vsock_start(struct vhost_vsock *vsock) return ret; } -static int vhost_vsock_stop(struct vhost_vsock *vsock) +static int vhost_vsock_stop(struct vhost_vsock *vsock, bool check_owner) { size_t i; int ret; mutex_lock(&vsock->dev.mutex); - ret = vhost_dev_check_owner(&vsock->dev); - if (ret) - goto err; + if (check_owner) { + ret = vhost_dev_check_owner(&vsock->dev); + if (ret) + goto err; + } for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { struct vhost_virtqueue *vq = &vsock->vqs[i]; @@ -753,7 +755,7 @@ static int vhost_vsock_dev_release(struct inode *inode, struct file *file) * inefficient. Room for improvement here. */ vsock_for_each_connected_socket(vhost_vsock_reset_orphans); - vhost_vsock_stop(vsock); + vhost_vsock_stop(vsock, false); vhost_vsock_flush(vsock); vhost_dev_stop(&vsock->dev); @@ -868,7 +870,7 @@ static long vhost_vsock_dev_ioctl(struct file *f, unsigned int ioctl, if (start) return vhost_vsock_start(vsock); else - return vhost_vsock_stop(vsock); + return vhost_vsock_stop(vsock, true); case VHOST_GET_FEATURES: features = VHOST_VSOCK_FEATURES; if (copy_to_user(argp, &features, sizeof(features)))