* [PATCH net v1] vsock: validate buffer min/max size in setsockopt
@ 2026-08-24 9:12 Rongguang Wei
2026-08-24 12:16 ` David Laight
0 siblings, 1 reply; 3+ messages in thread
From: Rongguang Wei @ 2026-08-24 9:12 UTC (permalink / raw)
To: sgarzare, davem, edumazet, kuba, pabeni, horms
Cc: virtualization, netdev, Rongguang Wei
From: Rongguang Wei <weirongguang@kylinos.cn>
SO_VM_SOCKETS_BUFFER_MIN_SIZE and SO_VM_SOCKETS_BUFFER_MAX_SIZE
do not cross-validate against each other, allowing userspace to
set buffer_min_size > buffer_max_size.
When min > max, buffer_size is silently clamped to an incorrect
value. For example, setting min=512KB then max=128 results in
buffer_size=128 despite the user requesting much larger buffers
via SO_VM_SOCKETS_BUFFER_SIZE.
Reproduced with a test program:
setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MIN_SIZE,
512 * 1024, sizeof(int));
setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MAX_SIZE,
128, sizeof(int));
// User asked for 1MB but got 128 bytes silently
setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_SIZE,
1024 * 1024, sizeof(int));
After that use getsockopt to get the buffer_size = 128 and
buffer_min_size = 524288, buffer_max_size = 128.
The buffer_min_size > buffer_max_size and the kernel accepted
contradictory values without error.
Add value check to fix this issue. Return -EINVAL to userspace
when setting MAX_SIZE to a value smaller than the current MIN_SIZE
or setting MIN_SIZE to a value larger than the current MAX_SIZE.
Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core")
Signed-off-by: Rongguang Wei <weirongguang@kylinos.cn>
---
net/vmw_vsock/af_vsock.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index a33b2a2d381d..5faa30ee8745 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -2050,12 +2050,20 @@ static int vsock_connectible_setsockopt(struct socket *sock,
case SO_VM_SOCKETS_BUFFER_MAX_SIZE:
COPY_IN(val);
+ if (val < vsk->buffer_min_size) {
+ err = -EINVAL;
+ goto exit;
+ }
vsk->buffer_max_size = val;
vsock_update_buffer_size(vsk, transport, vsk->buffer_size);
break;
case SO_VM_SOCKETS_BUFFER_MIN_SIZE:
COPY_IN(val);
+ if (val > vsk->buffer_max_size) {
+ err = -EINVAL;
+ goto exit;
+ }
vsk->buffer_min_size = val;
vsock_update_buffer_size(vsk, transport, vsk->buffer_size);
break;
--
2.25.1
No virus found
Checked by Hillstone Network AntiVirus
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net v1] vsock: validate buffer min/max size in setsockopt 2026-08-24 9:12 [PATCH net v1] vsock: validate buffer min/max size in setsockopt Rongguang Wei @ 2026-08-24 12:16 ` David Laight 2026-08-25 2:17 ` weirongguang 0 siblings, 1 reply; 3+ messages in thread From: David Laight @ 2026-08-24 12:16 UTC (permalink / raw) To: Rongguang Wei Cc: sgarzare, davem, edumazet, kuba, pabeni, horms, virtualization, netdev, Rongguang Wei On Mon, 24 Aug 2026 17:12:57 +0800 Rongguang Wei <clementwei90@163.com> wrote: > From: Rongguang Wei <weirongguang@kylinos.cn> > > SO_VM_SOCKETS_BUFFER_MIN_SIZE and SO_VM_SOCKETS_BUFFER_MAX_SIZE > do not cross-validate against each other, allowing userspace to > set buffer_min_size > buffer_max_size. > When min > max, buffer_size is silently clamped to an incorrect > value. For example, setting min=512KB then max=128 results in > buffer_size=128 despite the user requesting much larger buffers > via SO_VM_SOCKETS_BUFFER_SIZE. > > Reproduced with a test program: > setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MIN_SIZE, > 512 * 1024, sizeof(int)); > setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MAX_SIZE, > 128, sizeof(int)); > // User asked for 1MB but got 128 bytes silently > setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_SIZE, > 1024 * 1024, sizeof(int)); > > After that use getsockopt to get the buffer_size = 128 and > buffer_min_size = 524288, buffer_max_size = 128. > The buffer_min_size > buffer_max_size and the kernel accepted > contradictory values without error. > > Add value check to fix this issue. Return -EINVAL to userspace > when setting MAX_SIZE to a value smaller than the current MIN_SIZE > or setting MIN_SIZE to a value larger than the current MAX_SIZE. That is going to break userspace that sets the minimum before the maximum when the new minimum is larger than the old maximum. David > > Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core") > Signed-off-by: Rongguang Wei <weirongguang@kylinos.cn> > --- > net/vmw_vsock/af_vsock.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c > index a33b2a2d381d..5faa30ee8745 100644 > --- a/net/vmw_vsock/af_vsock.c > +++ b/net/vmw_vsock/af_vsock.c > @@ -2050,12 +2050,20 @@ static int vsock_connectible_setsockopt(struct socket *sock, > > case SO_VM_SOCKETS_BUFFER_MAX_SIZE: > COPY_IN(val); > + if (val < vsk->buffer_min_size) { > + err = -EINVAL; > + goto exit; > + } > vsk->buffer_max_size = val; > vsock_update_buffer_size(vsk, transport, vsk->buffer_size); > break; > > case SO_VM_SOCKETS_BUFFER_MIN_SIZE: > COPY_IN(val); > + if (val > vsk->buffer_max_size) { > + err = -EINVAL; > + goto exit; > + } > vsk->buffer_min_size = val; > vsock_update_buffer_size(vsk, transport, vsk->buffer_size); > break; ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net v1] vsock: validate buffer min/max size in setsockopt 2026-08-24 12:16 ` David Laight @ 2026-08-25 2:17 ` weirongguang 0 siblings, 0 replies; 3+ messages in thread From: weirongguang @ 2026-08-25 2:17 UTC (permalink / raw) To: David Laight, Rongguang Wei Cc: sgarzare, davem, edumazet, kuba, pabeni, horms, virtualization, netdev On 2026/8/24 20:16, David Laight wrote: > On Mon, 24 Aug 2026 17:12:57 +0800 > Rongguang Wei <clementwei90@163.com> wrote: > >> From: Rongguang Wei <weirongguang@kylinos.cn> >> >> SO_VM_SOCKETS_BUFFER_MIN_SIZE and SO_VM_SOCKETS_BUFFER_MAX_SIZE >> do not cross-validate against each other, allowing userspace to >> set buffer_min_size > buffer_max_size. >> When min > max, buffer_size is silently clamped to an incorrect >> value. For example, setting min=512KB then max=128 results in >> buffer_size=128 despite the user requesting much larger buffers >> via SO_VM_SOCKETS_BUFFER_SIZE. >> >> Reproduced with a test program: >> setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MIN_SIZE, >> 512 * 1024, sizeof(int)); >> setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_MAX_SIZE, >> 128, sizeof(int)); >> // User asked for 1MB but got 128 bytes silently >> setsockopt(fd, AF_VSOCK, SO_VM_SOCKETS_BUFFER_SIZE, >> 1024 * 1024, sizeof(int)); >> >> After that use getsockopt to get the buffer_size = 128 and >> buffer_min_size = 524288, buffer_max_size = 128. >> The buffer_min_size > buffer_max_size and the kernel accepted >> contradictory values without error. >> >> Add value check to fix this issue. Return -EINVAL to userspace >> when setting MAX_SIZE to a value smaller than the current MIN_SIZE >> or setting MIN_SIZE to a value larger than the current MAX_SIZE. > > That is going to break userspace that sets the minimum before the maximum > when the new minimum is larger than the old maximum. > > David > Hi, David. Thanks for pointing out the issue. Here is an alternative approach: instead of returning -EINVAL, automatically adjust the other value to preserve buffer_min_size <= buffer_max_size. The trade-off is that setting one parameter may implicitly adjust the other, but this is preferable to breaking existing applications. Does this approach look reasonable? --- diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index a33b2a2d381d..bd4646115af5 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -2050,12 +2050,18 @@ static int vsock_connectible_setsockopt(struct socket *sock, case SO_VM_SOCKETS_BUFFER_MAX_SIZE: COPY_IN(val); + /* If the new max is less than current min, shrink min to match. */ + if (val < vsk->buffer_min_size) + vsk->buffer_min_size = val; vsk->buffer_max_size = val; vsock_update_buffer_size(vsk, transport, vsk->buffer_size); break; case SO_VM_SOCKETS_BUFFER_MIN_SIZE: COPY_IN(val); + /* If the new min is greater than current max, expand max to match. */ + if (val > vsk->buffer_max_size) + vsk->buffer_max_size = val; vsk->buffer_min_size = val; vsock_update_buffer_size(vsk, transport, vsk->buffer_size); break; >> >> Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core") >> Signed-off-by: Rongguang Wei <weirongguang@kylinos.cn> >> --- >> net/vmw_vsock/af_vsock.c | 8 ++++++++ >> 1 file changed, 8 insertions(+) >> >> diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c >> index a33b2a2d381d..5faa30ee8745 100644 >> --- a/net/vmw_vsock/af_vsock.c >> +++ b/net/vmw_vsock/af_vsock.c >> @@ -2050,12 +2050,20 @@ static int vsock_connectible_setsockopt(struct socket *sock, >> >> case SO_VM_SOCKETS_BUFFER_MAX_SIZE: >> COPY_IN(val); >> + if (val < vsk->buffer_min_size) { >> + err = -EINVAL; >> + goto exit; >> + } >> vsk->buffer_max_size = val; >> vsock_update_buffer_size(vsk, transport, vsk->buffer_size); >> break; >> >> case SO_VM_SOCKETS_BUFFER_MIN_SIZE: >> COPY_IN(val); >> + if (val > vsk->buffer_max_size) { >> + err = -EINVAL; >> + goto exit; >> + } >> vsk->buffer_min_size = val; >> vsock_update_buffer_size(vsk, transport, vsk->buffer_size); >> break; ^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-25 2:17 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-08-24 9:12 [PATCH net v1] vsock: validate buffer min/max size in setsockopt Rongguang Wei 2026-08-24 12:16 ` David Laight 2026-08-25 2:17 ` weirongguang
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox