On Tue, Sep 15, 2026 at 02:30:50PM -0300, Aldo Ariel Panzardo wrote:
__vsock_net_mode_string() returns success without updating new_mode when the transfer length is zero. Its caller then reads the uninitialized enum and may permanently store a stack-derived value in the write-once child mode.Return before calling __vsock_net_mode_string() when *lenp is zero so that the helper is never invoked with nothing to parse and new_mode is never read uninitialized. This also prevents an empty write from locking the current mode. Fixes: eafb64f40ca4 ("vsock: add netns to vsock core") Cc: [email protected] Reviewed-by: Luigi Leonardi <[email protected]> Signed-off-by: Aldo Ariel Panzardo <[email protected]> --- Changes in v3: - Move the !*lenp early return before __vsock_net_mode_string() instead of after it, as suggested by Stefano Garzarella. - Add missing maintainer CCs per get_maintainer.pl. - Add Luigi's Reviewed-by. Changes in v2: - Return early instead of initializing new_mode to the current value, which would silently consume the write-once transition. net/vmw_vsock/af_vsock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 622dbd0467..XXXXXXX 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -2879,6 +2879,9 @@ static int vsock_net_child_mode_string(const struct ctl_table *table, int write, net = container_of(table->data, struct net, vsock.child_ns_mode); + if (!*lenp) + return 0; +
I would have moved it even before the net assignmet, but in any case, it doesn't make much difference:
Reviewed-by: Stefano Garzarella <[email protected]>
