vsock: Fix transport_* TOCTOU

JIRA: https://issues.redhat.com/browse/RHEL-106002
CVE: CVE-2025-38461

commit 687aa0c
Author: Michal Luczaj <mhal@rbox.co>
Date:   Thu Jul 3 17:18:19 2025 +0200

    vsock: Fix transport_* TOCTOU

    Transport assignment may race with module unload. Protect new_transport
    from becoming a stale pointer.

    This also takes care of an insecure call in vsock_use_local_transport();
    add a lockdep assert.

    BUG: unable to handle page fault for address: fffffbfff8056000
    Oops: Oops: 0000 [#1] SMP KASAN
    RIP: 0010:vsock_assign_transport+0x366/0x600
    Call Trace:
     vsock_connect+0x59c/0xc40
     __sys_connect+0xe8/0x100
     __x64_sys_connect+0x6e/0xc0
     do_syscall_64+0x92/0x1c0
     entry_SYSCALL_64_after_hwframe+0x4b/0x53

    Fixes: c0cfa2d ("vsock: add multi-transports support")
    Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
    Signed-off-by: Michal Luczaj <mhal@rbox.co>
    Link: https://patch.msgid.link/20250703-vsock-transports-toctou-v4-2-98f0eb530747@rbox.co
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

Signed-off-by: Jon Maloy <jmaloy@redhat.com>

Author: CKI Backport Bot

net/vmw_vsock/af_vsock.c

@@ -406,6 +406,8 @@ EXPORT_SYMBOL_GPL(vsock_enqueue_accept);
 
 static bool vsock_use_local_transport(unsigned int remote_cid)
 {
+	lockdep_assert_held(&vsock_register_mutex);
+
 	if (!transport_local)
 		return false;
 
@@ -463,6 +465,8 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
 
 	remote_flags = vsk->remote_addr.svm_flags;
 
+	mutex_lock(&vsock_register_mutex);
+
 	switch (sk->sk_type) {
 	case SOCK_DGRAM:
 		new_transport = transport_dgram;
@@ -478,12 +482,15 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
 			new_transport = transport_h2g;
 		break;
 	default:
-		return -ESOCKTNOSUPPORT;
+		ret = -ESOCKTNOSUPPORT;
+		goto err;
 	}
 
 	if (vsk->transport) {
-		if (vsk->transport == new_transport)
-			return 0;
+		if (vsk->transport == new_transport) {
+			ret = 0;
+			goto err;
+		}
 
 		/* transport->release() must be called with sock lock acquired.
 		 * This path can only be taken during vsock_connect(), where we
@@ -498,8 +505,16 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
 	/* We increase the module refcnt to prevent the transport unloading
 	 * while there are open sockets assigned to it.
 	 */
-	if (!new_transport || !try_module_get(new_transport->module))
-		return -ENODEV;
+	if (!new_transport || !try_module_get(new_transport->module)) {
+		ret = -ENODEV;
+		goto err;
+	}
+
+	/* It's safe to release the mutex after a successful try_module_get().
+	 * Whichever transport `new_transport` points at, it won't go away until
+	 * the last module_put() below or in vsock_deassign_transport().
+	 */
+	mutex_unlock(&vsock_register_mutex);
 
 	if (sk->sk_type == SOCK_SEQPACKET) {
 		if (!new_transport->seqpacket_allow ||
@@ -518,6 +533,9 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
 	vsk->transport = new_transport;
 
 	return 0;
+err:
+	mutex_unlock(&vsock_register_mutex);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(vsock_assign_transport);