Backport 7fbe078(vhost/vsock: fix vhost vsock cid hashing inconsistent)

Backport 7fbe078(vhost/vsock: fix vhost vsock cid hashing inconsistent)

[Shengjing Zhu]

commit 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 upstream(vhost/vsock:
fix vhost vsock cid hashing inconsistent) fixes
834e772c8db0c6a275d75315d90aba4ebbb1e249(vhost/vsock: fix
use-after-free in network stack callers)

Please backport 7fbe078 to 4.9, 4.14, 4.19, 4.20, since 834e772 was
applied there.

-- 
Best regards,
Shengjing Zhu

Re: Backport 7fbe078(vhost/vsock: fix vhost vsock cid hashing inconsistent)

[Greg KH]

On Wed, Mar 06, 2019 at 12:32:35AM +0800, Shengjing Zhu wrote:
> commit 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 upstream(vhost/vsock:
> fix vhost vsock cid hashing inconsistent) fixes
> 834e772c8db0c6a275d75315d90aba4ebbb1e249(vhost/vsock: fix
> use-after-free in network stack callers)
> 
> Please backport 7fbe078 to 4.9, 4.14, 4.19, 4.20, since 834e772 was
> applied there.

It does not apply to those trees, can you please provide a properly
backported version that I can use?

thanks,

greg k-h

[PATCH v4.20.y,v4.19.y,v4.14.y,v4.9.y] vhost/vsock: fix vhost vsock cid hashing inconsistent

[Shengjing Zhu]

From: Zha Bin <zhabin@linux.alibaba.com>

commit 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 upstream.

Backport from 5.0 tree, with diff hunk adjusted.

The vsock core only supports 32bit CID, but the Virtio-vsock spec define
CID (dst_cid and src_cid) as u64 and the upper 32bits is reserved as
zero. This inconsistency causes one bug in vhost vsock driver. The
scenarios is:

  0. A hash table (vhost_vsock_hash) is used to map an CID to a vsock
  object. And hash_min() is used to compute the hash key. hash_min() is
  defined as:
  (sizeof(val) <= 4 ? hash_32(val, bits) : hash_long(val, bits)).
  That means the hash algorithm has dependency on the size of macro
  argument 'val'.
  0. In function vhost_vsock_set_cid(), a 64bit CID is passed to
  hash_min() to compute the hash key when inserting a vsock object into
  the hash table.
  0. In function vhost_vsock_get(), a 32bit CID is passed to hash_min()
  to compute the hash key when looking up a vsock for an CID.

Because the different size of the CID, hash_min() returns different hash
key, thus fails to look up the vsock object for an CID.

To fix this bug, we keep CID as u64 in the IOCTLs and virtio message
headers, but explicitly convert u64 to u32 when deal with the hash table
and vsock core.

Fixes: 834e772c8db0 ("vhost/vsock: fix use-after-free in network stack callers")
Link: https://github.com/stefanha/virtio/blob/vsock/trunk/content.tex
Signed-off-by: Zha Bin <zhabin@linux.alibaba.com>
Reviewed-by: Liu Jiang <gerry@linux.alibaba.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Shengjing Zhu <i@zhsj.me>
---
 drivers/vhost/vsock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index fa93f6711d8d..e440f87ae1d6 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -642,7 +642,7 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid)
 		hash_del_rcu(&vsock->hash);
 
 	vsock->guest_cid = guest_cid;
-	hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid);
+	hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid);
 	spin_unlock_bh(&vhost_vsock_lock);
 
 	return 0;
-- 
2.20.1

Re: [PATCH v4.20.y,v4.19.y,v4.14.y,v4.9.y] vhost/vsock: fix vhost vsock cid hashing inconsistent

[Greg KH]

On Sun, Mar 10, 2019 at 04:02:31AM +0800, Shengjing Zhu wrote:
> From: Zha Bin <zhabin@linux.alibaba.com>
> 
> commit 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 upstream.
> 
> Backport from 5.0 tree, with diff hunk adjusted.

Now applied, thanks.

greg k-h