On Tue, Sep 15, 2026 at 02:30:50PM -0300, Aldo Ariel Panzardo wrote:
> __vsock_net_mode_string() returns success without updating new_mode when
> the transfer length is zero. Its caller then reads the uninitialized enum
> and may permanently store a stack-derived value in the write-once child
> mode.
>
> Return before calling __vsock_net_mode_string() when *lenp is zero so
> that the helper is never invoked with nothing to parse and new_mode is
> never read uninitialized. This also prevents an empty write from
> locking the current mode.
>
> Fixes: eafb64f40ca4 ("vsock: add netns to vsock core")
> Cc: [email protected]
> Reviewed-by: Luigi Leonardi <[email protected]>
> Signed-off-by: Aldo Ariel Panzardo <[email protected]>
> ---
>
> Changes in v3:
> - Move the !*lenp early return before __vsock_net_mode_string()
> instead of after it, as suggested by Stefano Garzarella.
> - Add missing maintainer CCs per get_maintainer.pl.
> - Add Luigi's Reviewed-by.
>
> Changes in v2:
> - Return early instead of initializing new_mode to the current
> value, which would silently consume the write-once transition.
>
> net/vmw_vsock/af_vsock.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
> index 622dbd0467..XXXXXXX 100644
> --- a/net/vmw_vsock/af_vsock.c
> +++ b/net/vmw_vsock/af_vsock.c
> @@ -2879,6 +2879,9 @@ static int vsock_net_child_mode_string(const struct
> ctl_table *table, int write,
>
> net = container_of(table->data, struct net, vsock.child_ns_mode);
>
> + if (!*lenp)
> + return 0;
> +
> ret = __vsock_net_mode_string(table, write, buffer, lenp, ppos,
> vsock_net_child_mode(net), &new_mode);
> if (ret)
>
> --
> 2.43.0
Reviewed-by: Bobby Eshleman <[email protected]>
