[PATCH] vsock: reject negative tv_usec in SO_VM_SOCKETS_CONNECT_TIMEOUT

[PATCH] vsock: reject negative tv_usec in SO_VM_SOCKETS_CONNECT_TIMEOUT

[phind.uet]

From: Nguyen Dinh Phi <phind.uet@gmail.com>

The timeval validation checks tv_usec < USEC_PER_SEC but not
tv_usec >= 0, so a negative tv_usec makes the timeout computation
wrap into a bogus value, later tripping "schedule_timeout: wrong
timeout value" instead of being rejected.

Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")

Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
---
 net/vmw_vsock/af_vsock.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index d0508887a2fb..1d7d53542724 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -2156,7 +2156,8 @@ static int vsock_connectible_setsockopt(struct socket *sock,
 					     optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD);
 		if (err)
 			break;
-		if (tv.tv_sec >= 0 && tv.tv_usec < USEC_PER_SEC &&
+		if (tv.tv_sec >= 0 && tv.tv_usec >= 0 &&
+		    tv.tv_usec < USEC_PER_SEC &&
 		    tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) {
 			vsk->connect_timeout = tv.tv_sec * HZ +
 				DIV_ROUND_UP((unsigned long)tv.tv_usec, (USEC_PER_SEC / HZ));
-- 
2.43.0

Re: [PATCH] vsock: reject negative tv_usec in SO_VM_SOCKETS_CONNECT_TIMEOUT

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] vsock: reject negative tv_usec in SO_VM_SOCKETS_CONNECT_TIMEOUT

[Stefano Garzarella]

On Fri, Oct 30, 2026 at 02:43:50PM +0800, phind.uet@gmail.com wrote:
>From: Nguyen Dinh Phi <phind.uet@gmail.com>
>
>The timeval validation checks tv_usec < USEC_PER_SEC but not
>tv_usec >= 0, so a negative tv_usec makes the timeout computation
>wrap into a bogus value, later tripping "schedule_timeout: wrong
>timeout value" instead of being rejected.
>
>Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
>

This blank line shouldn't be there, maybe it can be fixed when the net 
maintainers apply this patch, so please wait their comments before 
sending a v2.

>Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
>---
> net/vmw_vsock/af_vsock.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
>index d0508887a2fb..1d7d53542724 100644
>--- a/net/vmw_vsock/af_vsock.c
>+++ b/net/vmw_vsock/af_vsock.c
>@@ -2156,7 +2156,8 @@ static int vsock_connectible_setsockopt(struct socket *sock,
> 					     optname == SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD);
> 		if (err)
> 			break;
>-		if (tv.tv_sec >= 0 && tv.tv_usec < USEC_PER_SEC &&
>+		if (tv.tv_sec >= 0 && tv.tv_usec >= 0 &&
>+		    tv.tv_usec < USEC_PER_SEC &&
> 		    tv.tv_sec < (MAX_SCHEDULE_TIMEOUT / HZ - 1)) {
> 			vsk->connect_timeout = tv.tv_sec * HZ +
> 				DIV_ROUND_UP((unsigned long)tv.tv_usec, (USEC_PER_SEC / HZ));
>-- 
>2.43.0
>

LGTM:

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>