From 923feb67197c969cb5d3f349c3feff2441fb849e Mon Sep 17 00:00:00 2001 From: Daniel JB Clark Date: Sat, 17 Oct 2026 17:02:46 -0400 Subject: [PATCH 1/2] tsi: don't call a NULL getsockopt in tsi_stream_getsockopt() tsi_stream_getsockopt() calls isocket->ops->getsockopt or vsocket->ops->getsockopt unconditionally, but vsock_dgram_ops and the AF_UNIX proto_ops have no getsockopt. A getsockopt() at a level other than SOL_SOCKET on a TSI datagram socket that was proxied through vsock (for example IP_TOS on a connected UDP socket; reported with Chromium and systemd-resolved) calls a NULL pointer and oopses the guest kernel. Check the pointer and return -EOPNOTSUPP, which is what do_sock_getsockopt() returns for a socket without getsockopt. Also set err for an unexpected status instead of returning it uninitialized. Closes: https://github.com/libkrun/libkrunfw/issues/140 Signed-off-by: Daniel JB Clark Co-Authored-By: Claude Opus 5.5 --- ...-Socket-Impersonation-implementation.patch | 32 +++++++++++++------ 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/patches/0011-Transparent-Socket-Impersonation-implementation.patch b/patches/0011-Transparent-Socket-Impersonation-implementation.patch index e4e74958..672fce69 100644 --- a/patches/0011-Transparent-Socket-Impersonation-implementation.patch +++ b/patches/0011-Transparent-Socket-Impersonation-implementation.patch @@ -31,11 +31,11 @@ Signed-off-by: Matej Hrica net/socket.c | 3 + net/tsi/Kconfig | 7 + net/tsi/Makefile | 4 + - net/tsi/af_tsi.c | 1577 +++++++++++++++++++++++++++ + net/tsi/af_tsi.c | 1591 +++++++++++++++++++++++++++ net/tsi/af_tsi.h | 107 ++ security/selinux/hooks.c | 8 +- security/selinux/include/classmap.h | 3 +- - 10 files changed, 1716 insertions(+), 3 deletions(-) + 10 files changed, 1730 insertions(+), 3 deletions(-) create mode 100644 net/tsi/Kconfig create mode 100644 net/tsi/Makefile create mode 100644 net/tsi/af_tsi.c @@ -128,10 +128,10 @@ index 000000000000..8b3cf74116a5 +tsi-y := af_tsi.o diff --git a/net/tsi/af_tsi.c b/net/tsi/af_tsi.c new file mode 100644 -index 000000000000..3d2bcd8d2ba4 +index 000000000000..25309b3310c0 --- /dev/null +++ b/net/tsi/af_tsi.c -@@ -0,0 +1,1577 @@ +@@ -0,0 +1,1591 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Transparent Socket Impersonation Driver @@ -1152,16 +1152,30 @@ index 000000000000..3d2bcd8d2ba4 + pr_debug("%s: s=%p vs=%p is=%p st=%d\n", __func__, sock, vsocket, + isocket, tsk->status); + ++ /* ++ * Not every underlying socket implements getsockopt (vsock_dgram_ops ++ * and the AF_UNIX ops don't). Return what do_sock_getsockopt() returns ++ * for such a socket instead of calling through a NULL pointer. ++ */ + switch (tsk->status) { + case S_HYBRID: + case S_INET: -+ err = isocket->ops->getsockopt(isocket, level, optname, optval, -+ optlen); ++ if (isocket->ops->getsockopt) ++ err = isocket->ops->getsockopt(isocket, level, optname, ++ optval, optlen); ++ else ++ err = -EOPNOTSUPP; + break; + case S_VSOCK: -+ // TODO implement remote setsockopt -+ err = vsocket->ops->getsockopt(vsocket, level, optname, optval, -+ optlen); ++ // TODO implement remote getsockopt ++ if (vsocket->ops->getsockopt) ++ err = vsocket->ops->getsockopt(vsocket, level, optname, ++ optval, optlen); ++ else ++ err = -EOPNOTSUPP; ++ break; ++ default: ++ err = -EINVAL; + break; + } + From f8c3dc0be7445a966b6bfb41b4f70a3bb74c4582 Mon Sep 17 00:00:00 2001 From: Daniel JB Clark Date: Thu, 22 Oct 2026 09:45:34 -0400 Subject: [PATCH 2/2] tsi: drop unjustified -EINVAL default in getsockopt The NULL-pointer fix only needs the getsockopt guards. Status is always S_HYBRID/S_INET/S_VSOCK, and the original switch had no default; keep that. Co-authored-by: Cursor --- ...Transparent-Socket-Impersonation-implementation.patch | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/patches/0011-Transparent-Socket-Impersonation-implementation.patch b/patches/0011-Transparent-Socket-Impersonation-implementation.patch index 672fce69..70c5c896 100644 --- a/patches/0011-Transparent-Socket-Impersonation-implementation.patch +++ b/patches/0011-Transparent-Socket-Impersonation-implementation.patch @@ -31,11 +31,11 @@ Signed-off-by: Matej Hrica net/socket.c | 3 + net/tsi/Kconfig | 7 + net/tsi/Makefile | 4 + - net/tsi/af_tsi.c | 1591 +++++++++++++++++++++++++++ + net/tsi/af_tsi.c | 1588 +++++++++++++++++++++++++++ net/tsi/af_tsi.h | 107 ++ security/selinux/hooks.c | 8 +- security/selinux/include/classmap.h | 3 +- - 10 files changed, 1730 insertions(+), 3 deletions(-) + 10 files changed, 1727 insertions(+), 3 deletions(-) create mode 100644 net/tsi/Kconfig create mode 100644 net/tsi/Makefile create mode 100644 net/tsi/af_tsi.c @@ -131,7 +131,7 @@ new file mode 100644 index 000000000000..25309b3310c0 --- /dev/null +++ b/net/tsi/af_tsi.c -@@ -0,0 +1,1591 @@ +@@ -0,0 +1,1588 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Transparent Socket Impersonation Driver @@ -1174,9 +1174,6 @@ index 000000000000..25309b3310c0 + else + err = -EOPNOTSUPP; + break; -+ default: -+ err = -EINVAL; -+ break; + } + + release_sock(sk);