[PATCH net-next] vsock/test: Extend transport change null-ptr-deref test

[PATCH net-next] vsock/test: Extend transport change null-ptr-deref test

[Michal Luczaj]

syzkaller reported a lockdep lock order inversion warning[1] due to
commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU"). This was fixed in
commit f7c877e75352 ("vsock: fix lock inversion in
vsock_assign_transport()").

Redo syzkaller's repro by piggybacking on a somewhat related test
implemented in commit 3a764d93385c ("vsock/test: Add test for null ptr
deref when transport changes").

[1]: https://lore.kernel.org/netdev/68f6cdb0.a70a0220.205af.0039.GAE@google.com/

Signed-off-by: Michal Luczaj <mhal@rbox.co>
---
 tools/testing/vsock/vsock_test.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c
index d4517386e551..9e1250790f33 100644
--- a/tools/testing/vsock/vsock_test.c
+++ b/tools/testing/vsock/vsock_test.c
@@ -2015,6 +2015,11 @@ static void test_stream_transport_change_client(const struct test_opts *opts)
 			exit(EXIT_FAILURE);
 		}
 
+		/* Although setting SO_LINGER does not affect the original test
+		 * for null-ptr-deref, it may trigger a lockdep warning.
+		 */
+		enable_so_linger(s, 1);
+
 		ret = connect(s, (struct sockaddr *)&sa, sizeof(sa));
 		/* The connect can fail due to signals coming from the thread,
 		 * or because the receiver connection queue is full.
@@ -2352,7 +2357,7 @@ static struct test_case test_cases[] = {
 		.run_server = test_stream_nolinger_server,
 	},
 	{
-		.name = "SOCK_STREAM transport change null-ptr-deref",
+		.name = "SOCK_STREAM transport change null-ptr-deref, lockdep warn",
 		.run_client = test_stream_transport_change_client,
 		.run_server = test_stream_transport_change_server,
 	},

---
base-commit: 73138ebe792b9af2954292cc5cfa780a5e796d97
change-id: 20251121-vsock_test-linger-lockdep-warn-e4c5b8dea5e0

Best regards,
-- 
Michal Luczaj <mhal@rbox.co>

Re: [PATCH net-next] vsock/test: Extend transport change null-ptr-deref test

[Stefano Garzarella]

On Sun, Nov 23, 2025 at 10:43:59PM +0100, Michal Luczaj wrote:
>syzkaller reported a lockdep lock order inversion warning[1] due to
>commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU"). This was fixed in
>commit f7c877e75352 ("vsock: fix lock inversion in
>vsock_assign_transport()").
>
>Redo syzkaller's repro by piggybacking on a somewhat related test
>implemented in commit 3a764d93385c ("vsock/test: Add test for null ptr
>deref when transport changes").
>
>[1]: https://lore.kernel.org/netdev/68f6cdb0.a70a0220.205af.0039.GAE@google.com/
>
>Signed-off-by: Michal Luczaj <mhal@rbox.co>
>---
> tools/testing/vsock/vsock_test.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

>
>diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c
>index d4517386e551..9e1250790f33 100644
>--- a/tools/testing/vsock/vsock_test.c
>+++ b/tools/testing/vsock/vsock_test.c
>@@ -2015,6 +2015,11 @@ static void test_stream_transport_change_client(const struct test_opts *opts)
> 			exit(EXIT_FAILURE);
> 		}
>
>+		/* Although setting SO_LINGER does not affect the original test
>+		 * for null-ptr-deref, it may trigger a lockdep warning.
>+		 */
>+		enable_so_linger(s, 1);
>+
> 		ret = connect(s, (struct sockaddr *)&sa, sizeof(sa));
> 		/* The connect can fail due to signals coming from the thread,
> 		 * or because the receiver connection queue is full.
>@@ -2352,7 +2357,7 @@ static struct test_case test_cases[] = {
> 		.run_server = test_stream_nolinger_server,
> 	},
> 	{
>-		.name = "SOCK_STREAM transport change null-ptr-deref",
>+		.name = "SOCK_STREAM transport change null-ptr-deref, lockdep warn",
> 		.run_client = test_stream_transport_change_client,
> 		.run_server = test_stream_transport_change_server,
> 	},
>
>---
>base-commit: 73138ebe792b9af2954292cc5cfa780a5e796d97
>change-id: 20251121-vsock_test-linger-lockdep-warn-e4c5b8dea5e0
>
>Best regards,
>-- 
>Michal Luczaj <mhal@rbox.co>
>

Re: [PATCH net-next] vsock/test: Extend transport change null-ptr-deref test

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sun, 23 Nov 2025 22:43:59 +0100 you wrote:
> syzkaller reported a lockdep lock order inversion warning[1] due to
> commit 687aa0c5581b ("vsock: Fix transport_* TOCTOU"). This was fixed in
> commit f7c877e75352 ("vsock: fix lock inversion in
> vsock_assign_transport()").
> 
> Redo syzkaller's repro by piggybacking on a somewhat related test
> implemented in commit 3a764d93385c ("vsock/test: Add test for null ptr
> deref when transport changes").
> 
> [...]

Here is the summary with links:
  - [net-next] vsock/test: Extend transport change null-ptr-deref test
    https://git.kernel.org/netdev/net-next/c/b796632fc83c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html