Evolution-X-Devices/kernel_xiaomi_garnet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "vsock: Fix transport_* TOCTOU"

Browse Source 
This reverts commit 8667e8d0eb which is
commit 687aa0c5581b8d4aa87fd92973e4ee576b550cdf upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I86ea3bed3dc2db62fb68a08cf51bca5194509144
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman
2025-07-18 11:52:29 +00:00
parent cab4cd3ccf
commit d1d6db1a2b
1 changed files with 5 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
net/vmw_vsock/af_vsock.c
View File

@@ -395,8 +395,6 @@ EXPORT_SYMBOL_GPL(vsock_enqueue_accept);
static bool vsock_use_local_transport(unsigned int remote_cid)
{
lockdep_assert_held(&vsock_register_mutex);
if (!transport_local)
return false;
@@ -454,8 +452,6 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
remote_flags = vsk->remote_addr.svm_flags;
mutex_lock(&vsock_register_mutex);
switch (sk->sk_type) {
case SOCK_DGRAM:
new_transport = transport_dgram;
@@ -470,15 +466,12 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
new_transport = transport_h2g;
break;
default:
ret = -ESOCKTNOSUPPORT;
goto err;
return -ESOCKTNOSUPPORT;
}
if (vsk->transport) {
if (vsk->transport == new_transport) {
ret = 0;
goto err;
}
if (vsk->transport == new_transport)
return 0;
/* transport->release() must be called with sock lock acquired.
* This path can only be taken during vsock_stream_connect(),
@@ -502,16 +495,8 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
/* We increase the module refcnt to prevent the transport unloading
* while there are open sockets assigned to it.
*/
if (!new_transport || !try_module_get(new_transport->module)) {
ret = -ENODEV;
goto err;
}
/* It's safe to release the mutex after a successful try_module_get().
* Whichever transport `new_transport` points at, it won't go away until
* the last module_put() below or in vsock_deassign_transport().
*/
mutex_unlock(&vsock_register_mutex);
if (!new_transport || !try_module_get(new_transport->module))
return -ENODEV;
ret = new_transport->init(vsk, psk);
if (ret) {
@@ -522,9 +507,6 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
vsk->transport = new_transport;
return 0;
err:
mutex_unlock(&vsock_register_mutex);
return ret;
}
EXPORT_SYMBOL_GPL(vsock_assign_transport);