Zha Bin 9ad64a53fd vhost/vsock: fix vhost vsock cid hashing inconsistent ... commit 7fbe078c37 upstream. The vsock core only supports 32bit CID, but the Virtio-vsock spec define CID (dst_cid and src_cid) as u64 and the upper 32bits is reserved as zero. This inconsistency causes one bug in vhost vsock driver. The scenarios is: 0. A hash table (vhost_vsock_hash) is used to map an CID to a vsock object. And hash_min() is used to compute the hash key. hash_min() is defined as: (sizeof(val) <= 4 ? hash_32(val, bits) : hash_long(val, bits)). That means the hash algorithm has dependency on the size of macro argument 'val'. 0. In function vhost_vsock_set_cid(), a 64bit CID is passed to hash_min() to compute the hash key when inserting a vsock object into the hash table. 0. In function vhost_vsock_get(), a 32bit CID is passed to hash_min() to compute the hash key when looking up a vsock for an CID. Because the different size of the CID, hash_min() returns different hash key, thus fails to look up the vsock object for an CID. To fix this bug, we keep CID as u64 in the IOCTLs and virtio message headers, but explicitly convert u64 to u32 when deal with the hash table and vsock core. Fixes: 834e772c8d ("vhost/vsock: fix use-after-free in network stack callers") Link: https://github.com/stefanha/virtio/blob/vsock/trunk/content.tex Signed-off-by: Zha Bin <zhabin@linux.alibaba.com> Reviewed-by: Liu Jiang <gerry@linux.alibaba.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Shengjing Zhu <i@zhsj.me> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-03-19 13:11:56 +01:00
..
Kconfig	vhost: allow vhost-scsi driver to be built-in	2018-08-22 01:01:32 +03:00
Kconfig.vringh	vhost: split out vringh Kconfig	2016-08-02 16:54:28 +03:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
net.c	vhost: fix OOB in get_rx_bufs()	2019-02-06 17:27:37 +01:00
scsi.c	vhost/scsi: Use copy_to_iter() to send control queue response	2019-02-27 10:09:48 +01:00
test.c	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
test.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
vhost.c	vhost: return EINVAL if iovecs size does not match the message size	2019-02-27 10:09:48 +01:00
vhost.h	vhost: fix OOB in get_rx_bufs()	2019-02-06 17:27:37 +01:00
vringh.c	treewide: kmalloc() -> kmalloc_array()	2018-06-12 16:19:22 -07:00
vsock.c	vhost/vsock: fix vhost vsock cid hashing inconsistent	2019-03-19 13:11:56 +01:00