Drivers: hv: Don't reset VMBus connection state on error/exit paths
Impact
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Linux · Linux
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 74347a99e73ae00b8385f1209aaea193c670f901 to before f47ce27af80b87cc684d5c12b65506af498ac7e5 | affected |
| 74347a99e73ae00b8385f1209aaea193c670f901 to before 3195546a377c2d8d176d837e8baad5ce15d11195 | affected |
| 74347a99e73ae00b8385f1209aaea193c670f901 to before ec31dc39e835ccde0930daccece8c492d28282fc | affected |
| 5e059fc0f054309036d3f612bc8b0a502ca58545 | affected |
| 9f38f7b46de0747c1909e8c557aa21715dce20c5 | affected |
| caeeb3787167c884b955404a7e669fd77f267e44 | affected |
| 4.19.118 to before 4.20 | affected |
| 5.4.35 to before 5.5 | affected |
| 5.6.7 to before 5.7 | affected |
Linux · Linux
Other versions: affected
| Version / range | Source status |
|---|---|
| 5.7 | affected |
| 0 to before 5.7 | unaffected |
| 6.18.59 through 6.18.* (inclusive) | unaffected |
| 7.2.13 through 7.2.* (inclusive) | unaffected |
| 7.3 through * (inclusive) | unaffected |
Original source description
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts.
The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time.
Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.