search for: dst_cid

When we receive a new packet from the guest, we check if the src_cid is correct, but we forgot to check the dst_cid. The host should accept only packets where dst_cid is equal to the host CID. Signed-off-by: Stefano Garzarella <sgarzare at redhat.com> --- drivers/vhost/vsock.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 50de0...

When we receive a new packet from the guest, we check if the src_cid is correct, but we forgot to check the dst_cid. The host should accept only packets where dst_cid is equal to the host CID. Signed-off-by: Stefano Garzarella <sgarzare at redhat.com> --- drivers/vhost/vsock.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 50de0...

On Wed, Dec 11, 2019 at 11:03:07AM -0500, Michael S. Tsirkin wrote: > On Fri, Dec 06, 2019 at 03:39:12PM +0100, Stefano Garzarella wrote: > > When we receive a new packet from the guest, we check if the > > src_cid is correct, but we forgot to check the dst_cid. > > > > The host should accept only packets where dst_cid is > > equal to the host CID. > > > > Signed-off-by: Stefano Garzarella <sgarzare at redhat.com> > > Stefano can you clarify the impact pls? Sure, I'm sorry I didn't do it earlier. >...

On Wed, Dec 11, 2019 at 11:03:07AM -0500, Michael S. Tsirkin wrote: > On Fri, Dec 06, 2019 at 03:39:12PM +0100, Stefano Garzarella wrote: > > When we receive a new packet from the guest, we check if the > > src_cid is correct, but we forgot to check the dst_cid. > > > > The host should accept only packets where dst_cid is > > equal to the host CID. > > > > Signed-off-by: Stefano Garzarella <sgarzare at redhat.com> > > Stefano can you clarify the impact pls? Sure, I'm sorry I didn't do it earlier. >...

...On Wed, Dec 11, 2019 at 11:03:07AM -0500, Michael S. Tsirkin wrote: > > > On Fri, Dec 06, 2019 at 03:39:12PM +0100, Stefano Garzarella wrote: > > > > When we receive a new packet from the guest, we check if the > > > > src_cid is correct, but we forgot to check the dst_cid. > > > > > > > > The host should accept only packets where dst_cid is > > > > equal to the host CID. > > > > > > > > Signed-off-by: Stefano Garzarella <sgarzare at redhat.com> > > > > > > Stefano can you clarify...

...w_vsock/virtio_transport_common.c > +++ b/net/vmw_vsock/virtio_transport_common.c > @@ -606,9 +606,9 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt) > return 0; > > pkt = virtio_transport_alloc_pkt(&info, 0, > - le32_to_cpu(pkt->hdr.dst_cid), > + le64_to_cpu(pkt->hdr.dst_cid), > le32_to_cpu(pkt->hdr.dst_port), > - le32_to_cpu(pkt->hdr.src_cid), > + le64_to_cpu(pkt->hdr.src_cid), > le32_to_cpu(pkt->hdr.src_port)); Looking at sockaddr_vm, svm_cid is "unsigned int",...

...w_vsock/virtio_transport_common.c > +++ b/net/vmw_vsock/virtio_transport_common.c > @@ -606,9 +606,9 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt) > return 0; > > pkt = virtio_transport_alloc_pkt(&info, 0, > - le32_to_cpu(pkt->hdr.dst_cid), > + le64_to_cpu(pkt->hdr.dst_cid), > le32_to_cpu(pkt->hdr.dst_port), > - le32_to_cpu(pkt->hdr.src_cid), > + le64_to_cpu(pkt->hdr.src_cid), > le32_to_cpu(pkt->hdr.src_port)); Looking at sockaddr_vm, svm_cid is "unsigned int",...

...lla wrote: > On Wed, Dec 11, 2019 at 11:03:07AM -0500, Michael S. Tsirkin wrote: > > On Fri, Dec 06, 2019 at 03:39:12PM +0100, Stefano Garzarella wrote: > > > When we receive a new packet from the guest, we check if the > > > src_cid is correct, but we forgot to check the dst_cid. > > > > > > The host should accept only packets where dst_cid is > > > equal to the host CID. > > > > > > Signed-off-by: Stefano Garzarella <sgarzare at redhat.com> > > > > Stefano can you clarify the impact pls? > > Sure, I&...

On Fri, Dec 06, 2019 at 03:39:12PM +0100, Stefano Garzarella wrote: > When we receive a new packet from the guest, we check if the > src_cid is correct, but we forgot to check the dst_cid. > > The host should accept only packets where dst_cid is > equal to the host CID. > > Signed-off-by: Stefano Garzarella <sgarzare at redhat.com> what's the implication of processing incorrect dst cid? I think mostly it's malformed guests, right? Everyone else just p...

On Fri, Dec 06, 2019 at 03:39:12PM +0100, Stefano Garzarella wrote: > When we receive a new packet from the guest, we check if the > src_cid is correct, but we forgot to check the dst_cid. > > The host should accept only packets where dst_cid is > equal to the host CID. > > Signed-off-by: Stefano Garzarella <sgarzare at redhat.com> Stefano can you clarify the impact pls? E.g. is this needed on stable? Etc. Thanks! > --- > drivers/vhost/vsock.c | 4 ++...

...0384..22e99c4 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -606,9 +606,9 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt) return 0; pkt = virtio_transport_alloc_pkt(&info, 0, - le32_to_cpu(pkt->hdr.dst_cid), + le64_to_cpu(pkt->hdr.dst_cid), le32_to_cpu(pkt->hdr.dst_port), - le32_to_cpu(pkt->hdr.src_cid), + le64_to_cpu(pkt->hdr.src_cid), le32_to_cpu(pkt->hdr.src_port)); if (!pkt) return -ENOMEM; @@ -823,7 +823,7 @@ virtio_transport_send_response(struct...

This series is based on Michael Tsirkin's vhost branch (v4.5-rc6). I'm about to process Claudio Imbrenda's locking fixes for virtio-vsock but first I want to share the latest version of the code. Several people are playing with vsock now so sharing the latest code should avoid duplicate work. v5: * Transport reset event for live migration support * Reorder virtqueues, drop unused

This series is based on Michael Tsirkin's vhost branch (v4.5-rc6). I'm about to process Claudio Imbrenda's locking fixes for virtio-vsock but first I want to share the latest version of the code. Several people are playing with vsock now so sharing the latest code should avoid duplicate work. v5: * Transport reset event for live migration support * Reorder virtqueues, drop unused

This series is based on v4.4-rc2 and the "virtio: make find_vqs() checkpatch.pl-friendly" patch I recently submitted. v4: * Addressed code review comments from Alex Bennee * MAINTAINERS file entries for new files * Trace events instead of pr_debug() * RST packet is sent when there is no listen socket * Allow guest->host connections again (began discussing netfilter support with

This series is based on v4.4-rc2 and the "virtio: make find_vqs() checkpatch.pl-friendly" patch I recently submitted. v4: * Addressed code review comments from Alex Bennee * MAINTAINERS file entries for new files * Trace events instead of pr_debug() * RST packet is sent when there is no listen socket * Allow guest->host connections again (began discussing netfilter support with

This series is based on v4.7. This RFC is the implementation for the new VIRTIO Socket device. It is developed in parallel with the VIRTIO device specification and proves the design. Once the specification has been accepted I will send a non-RFC version of this patch series. v6: * Add VHOST_VSOCK_SET_RUNNING ioctl to start/stop vhost cleanly * Add graceful shutdown to avoid port reuse while

This series is based on v4.7. This RFC is the implementation for the new VIRTIO Socket device. It is developed in parallel with the VIRTIO device specification and proves the design. Once the specification has been accepted I will send a non-RFC version of this patch series. v6: * Add VHOST_VSOCK_SET_RUNNING ioctl to start/stop vhost cleanly * Add graceful shutdown to avoid port reuse while

...>+} >+ > /* Returns a new packet on success, otherwise returns NULL. > * > * If NULL is returned, errp is set to a negative errno. >@@ -47,15 +210,31 @@ virtio_transport_alloc_skb(struct virtio_vsock_pkt_info *info, > u32 src_cid, > u32 src_port, > u32 dst_cid, >- u32 dst_port) >+ u32 dst_port, >+ struct vsock_sock *vsk) > { >- const size_t skb_len = VIRTIO_VSOCK_SKB_HEADROOM + len; >+ const size_t skb_len = VIRTIO_VSOCK_SKB_HEADROOM; > struct virtio_vsock_hdr *hdr; > struct sk_buff *skb; >- void *payload; >...

...s/vhost/vsock.c @@ -210,21 +210,27 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt) struct vhost_vsock *vsock; int len = pkt->len; + spin_lock_bh(&vhost_vsock_lock); + /* Find the vhost_vsock according to guest context id */ - vsock = vhost_vsock_get(le64_to_cpu(pkt->hdr.dst_cid)); + vsock = __vhost_vsock_get(le64_to_cpu(pkt->hdr.dst_cid)); if (!vsock) { virtio_transport_free_pkt(pkt); + spin_unlock_bh(&vhost_vsock_lock); return -ENODEV; } if (pkt->reply) atomic_inc(&vsock->queued_replies); - spin_lock_bh(&vsock->send_pkt_list_lo...

...s/vhost/vsock.c @@ -210,21 +210,27 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt) struct vhost_vsock *vsock; int len = pkt->len; + spin_lock_bh(&vhost_vsock_lock); + /* Find the vhost_vsock according to guest context id */ - vsock = vhost_vsock_get(le64_to_cpu(pkt->hdr.dst_cid)); + vsock = __vhost_vsock_get(le64_to_cpu(pkt->hdr.dst_cid)); if (!vsock) { virtio_transport_free_pkt(pkt); + spin_unlock_bh(&vhost_vsock_lock); return -ENODEV; } if (pkt->reply) atomic_inc(&vsock->queued_replies); - spin_lock_bh(&vsock->send_pkt_list_lo...