samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FROMGIT: vsock/virtio: Move SKB allocation lower-bound check to callers

Browse Source 
virtio_vsock_alloc_linear_skb() checks that the requested size is at
least big enough for the packet header (VIRTIO_VSOCK_SKB_HEADROOM).

Of the three callers of virtio_vsock_alloc_linear_skb(), only
vhost_vsock_alloc_skb() can potentially pass a packet smaller than the
header size and, as it already has a check against the maximum packet
size, extend its bounds checking to consider the minimum packet size
and remove the check from virtio_vsock_alloc_linear_skb().

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Will Deacon <will@kernel.org>
Message-Id: <20250717090116.11987-7-will@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 1b21842062ebff3ee56ddde87b204391c8786705
 git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git vhost)
Bug: 421244320
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I496896bd59f57375f7ba954161c3f0f77e62619b
This commit is contained in:
Will Deacon
2025-07-17 10:01:13 +01:00
committed by Isaac Manjarres
parent 80b36821c2
commit 5044ed745e
2 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/vhost/vsock.c
View File

@@ -344,7 +344,8 @@ vhost_vsock_alloc_skb(struct vhost_virtqueue *vq,
len = iov_length(vq->iov, out); len = iov_length(vq->iov, out);
if (len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM) if (len < VIRTIO_VSOCK_SKB_HEADROOM ||
len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM)
return NULL; return NULL;
/* len contains both payload and hdr */ /* len contains both payload and hdr */

3
include/linux/virtio_vsock.h
View File

@@ -57,9 +57,6 @@ virtio_vsock_alloc_linear_skb(unsigned int size, gfp_t mask)
{ {
struct sk_buff *skb; struct sk_buff *skb;
if (size < VIRTIO_VSOCK_SKB_HEADROOM)
return NULL;
skb = alloc_skb(size, mask); skb = alloc_skb(size, mask);
if (!skb) if (!skb)
return NULL; return NULL;