[Hyper-V] vsock: always call vsock_init_tables()
Bug #1747970 reported by
Joshua R. Poulson
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux-azure (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned | ||
Xenial |
Fix Released
|
Undecided
|
Marcelo Cerri | ||
linux-azure-edge (Ubuntu) |
New
|
Undecided
|
Unassigned | ||
Xenial |
In Progress
|
Undecided
|
Unassigned |
Bug Description
Guest kernel panic for VMs in enhanced session mode when the XRDP channel connection happens too early in the boot.
vsock: always call vsock_init_tables()
Although CONFIG_
vsock_init_tables() is not always called, it is called only
if other modules call its caller. Therefore if we only
enable CONFIG_
vsock_bind_table.
This patch fixes it by moving vsock_init_tables() to its own
module_init().
CVE References
Changed in linux-azure (Ubuntu): | |
status: | New → Confirmed |
Changed in linux-azure (Ubuntu Xenial): | |
assignee: | nobody → Marcelo Cerri (mhcerri) |
status: | New → In Progress |
Changed in linux-azure (Ubuntu Xenial): | |
status: | In Progress → Fix Committed |
To post a comment you must log in.
Yes, I confirm this is the patch we need for the Enhanced Session mode.
The patch was originally made to fix a different issue, but it can also fix the VM panic we see with Enhanced Session mode, because the cause is the same: there is a race
static int __init hvs_init(void)
{
int ret;
if (vmbus_ proto_version < VERSION_WIN10)
return -ENODEV;
ret = vmbus_driver_ register( &hvs_drv) ;
return ret; ------- ------- ------: if the host-initiated connection comes here (e.g. before we call vsock_core_init(), hvs_open_ connection( ) -> vsock_find_ bound_socket( ) -> __vsock_ find_bound_ socket( ) can access the uninitialized vsock_bound_ sockets( addr) -> vsock_bind_table, which will be initialized in vsock_core_init() -> vsock_init_ tables( ), and we'll hit a panic.
if (ret != 0)
Dexuan: -------
ret = vsock_core_ init(&hvs_ transport) ;
vmbus_ driver_ unregister( &hvs_drv) ;
return ret;
if (ret) {
}
return 0;
}
The latest upstream 4.15.1 kernel has the fix already, but 4.14.17 doesn't have the fix.