Re: [PATCH v2] vsock: ignore empty child namespace mode writes

[Luigi Leonardi]

Hi Aldo,

On Tue, Sep 15, 2026 at 11:15:47AM -0300, Aldo Ariel Panzardo wrote:
> __vsock_net_mode_string() returns success without updating new_mode when
> the transfer length is zero. Its caller then reads the uninitialized enum
> and may permanently store a stack-derived value in the write-once child
> mode.
>
> Return before inspecting or storing new_mode when no bytes were
> transferred. This also prevents an empty write from locking the current
> mode.
>
> Fixes: eafb64f40ca4 ("vsock: add netns to vsock core")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@xxxxxxxxx>
> ---
> net/vmw_vsock/af_vsock.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
> index 622dbd0467..816d25b314 100644
> --- a/net/vmw_vsock/af_vsock.c
> +++ b/net/vmw_vsock/af_vsock.c
> @@ -2883,6 +2883,8 @@ static int vsock_net_child_mode_string(const struct ctl_table *table, int write,
> 				      vsock_net_child_mode(net), &new_mode);
> 	if (ret)
> 		return ret;
> +	if (!*lenp)
> +		return 0;
>
> 	if (write) {
> 		/* Prevent a "local" namespace from escalating to "global",
> --
> 2.43.0

Code LGTM.
Reviewed-by: Luigi Leonardi <leonardi@xxxxxxxxxx>

To reproduce it, I suppose we need a kernel that does not come with
`CONFIG_INIT_STACK_ALL_ZERO` set.

@Stefano do you think it's worth adding a test for this case?

Just out of curiosity, how did you find this bug?

Thanks,
Luigi