On Tue, Sep 15, 2026 at 06:32:59PM +0200, Luigi Leonardi wrote:
Hi Aldo,
On Tue, Sep 15, 2026 at 11:15:47AM -0300, Aldo Ariel Panzardo wrote:
__vsock_net_mode_string() returns success without updating new_mode when
the transfer length is zero. Its caller then reads the uninitialized enum
and may permanently store a stack-derived value in the write-once child
mode.
Return before inspecting or storing new_mode when no bytes were
transferred. This also prevents an empty write from locking the current
mode.
Fixes: eafb64f40ca4 ("vsock: add netns to vsock core")
Cc: [email protected]
Signed-off-by: Aldo Ariel Panzardo <[email protected]>
---
net/vmw_vsock/af_vsock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 622dbd0467..816d25b314 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -2883,6 +2883,8 @@ static int vsock_net_child_mode_string(const struct
ctl_table *table, int write,
vsock_net_child_mode(net), &new_mode);
if (ret)
return ret;
+ if (!*lenp)
+ return 0;
if (write) {
/* Prevent a "local" namespace from escalating to "global",
--
2.43.0
Code LGTM.
Reviewed-by: Luigi Leonardi <[email protected]>
To reproduce it, I suppose we need a kernel that does not come with
`CONFIG_INIT_STACK_ALL_ZERO` set.
@Stefano do you think it's worth adding a test for this case?
Not a strong opinion on this on my side.
Thanks,
Stefano
Just out of curiosity, how did you find this bug?
Thanks,
Luigi
