Merge: vsock/virtio: Validate length in packet header before skb_put()

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7459

vsock/virtio: Validate length in packet header before skb_put()

JIRA: https://issues.redhat.com/browse/RHEL-114300
CVE: CVE-2025-39718

commit 0dab924
Author: Will Deacon <will@kernel.org>
Date:   Thu Jul 17 10:01:09 2025 +0100

    sock/virtio: Validate length in packet header before skb_put()

    When receiving a vsock packet in the guest, only the virtqueue buffer
    size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately,
    virtio_vsock_skb_rx_put() uses the length from the packet header as the
    length argument to skb_put(), potentially resulting in SKB overflow if
    the host has gone wonky.

    Validate the length as advertised by the packet header before calling
    virtio_vsock_skb_rx_put().

    Cc: <stable@vger.kernel.org>
    Fixes: 71dc9ec ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
    Signed-off-by: Will Deacon <will@kernel.org>
    Message-Id: <20250717090116.11987-3-will@kernel.org>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

Signed-off-by: Jon Maloy <jmaloy@redhat.com>

Approved-by: Stefano Garzarella <sgarzare@redhat.com>
Approved-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Approved-by: Stefan Hajnoczi <stefanha@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>

Author: CKI KWF Bot

net/vmw_vsock/virtio_transport.c

@@ -582,8 +582,9 @@ static void virtio_transport_rx_work(struct work_struct *work)
 	do {
 		virtqueue_disable_cb(vq);
 		for (;;) {
+			unsigned int len, payload_len;
+			struct virtio_vsock_hdr *hdr;
 			struct sk_buff *skb;
-			unsigned int len;
 
 			if (!virtio_transport_more_replies(vsock)) {
 				/* Stop rx until the device processes already
@@ -600,12 +601,19 @@ static void virtio_transport_rx_work(struct work_struct *work)
 			vsock->rx_buf_nr--;
 
 			/* Drop short/long packets */
-			if (unlikely(len < sizeof(struct virtio_vsock_hdr) ||
+			if (unlikely(len < sizeof(*hdr) ||
 				     len > virtio_vsock_skb_len(skb))) {
 				kfree_skb(skb);
 				continue;
 			}
 
+			hdr = virtio_vsock_hdr(skb);
+			payload_len = le32_to_cpu(hdr->len);
+			if (unlikely(payload_len > len - sizeof(*hdr))) {
+				kfree_skb(skb);
+				continue;
+			}
+
 			virtio_vsock_skb_rx_put(skb);
 			virtio_transport_deliver_tap_pkt(skb);
 			virtio_transport_recv_pkt(&virtio_transport, skb);