vsock/virtio: discard packets if the transport changes

JIRA: https://issues.redhat.com/browse/RHEL-77228
CVE: CVE-2025-21669

commit 2cb7c75
Author: Stefano Garzarella <sgarzare@redhat.com>
Date:   Fri Jan 10 09:35:07 2025 +0100

    vsock/virtio: discard packets if the transport changes

    If the socket has been de-assigned or assigned to another transport,
    we must discard any packets received because they are not expected
    and would cause issues when we access vsk->transport.

    A possible scenario is described by Hyunwoo Kim in the attached link,
    where after a first connect() interrupted by a signal, and a second
    connect() failed, we can find `vsk->transport` at NULL, leading to a
    NULL pointer dereference.

    Fixes: c0cfa2d ("vsock: add multi-transports support")
    Cc: stable@vger.kernel.org
    Reported-by: Hyunwoo Kim <v4bel@theori.io>
    Reported-by: Wongi Lee <qwerty@theori.io>
    Closes: https://lore.kernel.org/netdev/Z2LvdTTQR7dBmPb5@v4bel-B760M-AORUS-ELITE-AX/
    Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
    Reviewed-by: Hyunwoo Kim <v4bel@theori.io>
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

Author: CKI Backport Bot

net/vmw_vsock/virtio_transport_common.c

@@ -1576,8 +1576,11 @@ void virtio_transport_recv_pkt(struct virtio_transport *t,
 
 	lock_sock(sk);
 
-	/* Check if sk has been closed before lock_sock */
-	if (sock_flag(sk, SOCK_DONE)) {
+	/* Check if sk has been closed or assigned to another transport before
+	 * lock_sock (note: listener sockets are not assigned to any transport)
+	 */
+	if (sock_flag(sk, SOCK_DONE) ||
+	    (sk->sk_state != TCP_LISTEN && vsk->transport != &t->transport)) {
 		(void)virtio_transport_reset_no_sock(t, skb);
 		release_sock(sk);
 		sock_put(sk);