[PATCH net] vsock: Do not allow binding to VMADDR_PORT_ANY

[PATCH net] vsock: Do not allow binding to VMADDR_PORT_ANY

[Budimir Markovic]

It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can
cause a use-after-free when a connection is made to the bound socket.
The socket returned by accept() also has port VMADDR_PORT_ANY but is not
on the list of unbound sockets. Binding it will result in an extra
refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep
the binding until socket destruction).

Modify the check in __vsock_bind_connectible() to also prevent binding
to VMADDR_PORT_ANY.

Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com>
---
 net/vmw_vsock/af_vsock.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index ead6a3c14..bebb355f3 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -689,7 +689,8 @@ static int __vsock_bind_connectible(struct vsock_sock *vsk,
 		unsigned int i;
 
 		for (i = 0; i < MAX_PORT_RETRIES; i++) {
-			if (port <= LAST_RESERVED_PORT)
+			if (port == VMADDR_PORT_ANY ||
+			    port <= LAST_RESERVED_PORT)
 				port = LAST_RESERVED_PORT + 1;
 
 			new_addr.svm_port = port++;
-- 
2.49.1

Re: [PATCH net] vsock: Do not allow binding to VMADDR_PORT_ANY

[Stefano Garzarella]

On Thu, Aug 07, 2025 at 04:18:11AM +0000, Budimir Markovic wrote:
>It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can
>cause a use-after-free when a connection is made to the bound socket.
>The socket returned by accept() also has port VMADDR_PORT_ANY but is not
>on the list of unbound sockets. Binding it will result in an extra
>refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep
>the binding until socket destruction).
>
>Modify the check in __vsock_bind_connectible() to also prevent binding
>to VMADDR_PORT_ANY.
>
>Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
>Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
>Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com>
>---
> net/vmw_vsock/af_vsock.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)

Thanks for the fix!

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

Please next time use `./scripts/get_maintainer.pl` to cc all the
maintainers and mailing lists.

If this patch will not be merged, resend it (with my R-b) to all the
maintainers/list. I'll be offline for the next 2 weeks, so remember to
carry my R-b.

Thanks,
Stefano

>
>diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
>index ead6a3c14..bebb355f3 100644
>--- a/net/vmw_vsock/af_vsock.c
>+++ b/net/vmw_vsock/af_vsock.c
>@@ -689,7 +689,8 @@ static int __vsock_bind_connectible(struct vsock_sock *vsk,
> 		unsigned int i;
>
> 		for (i = 0; i < MAX_PORT_RETRIES; i++) {
>-			if (port <= LAST_RESERVED_PORT)
>+			if (port == VMADDR_PORT_ANY ||
>+			    port <= LAST_RESERVED_PORT)
> 				port = LAST_RESERVED_PORT + 1;
>
> 			new_addr.svm_port = port++;
>-- 
>2.49.1
>

Re: [PATCH net] vsock: Do not allow binding to VMADDR_PORT_ANY

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu,  7 Aug 2025 04:18:11 +0000 you wrote:
> It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can
> cause a use-after-free when a connection is made to the bound socket.
> The socket returned by accept() also has port VMADDR_PORT_ANY but is not
> on the list of unbound sockets. Binding it will result in an extra
> refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep
> the binding until socket destruction).
> 
> [...]

Here is the summary with links:
  - [net] vsock: Do not allow binding to VMADDR_PORT_ANY
    https://git.kernel.org/netdev/net/c/aba0c94f61ec

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html