Re: [PATCH net v2] vsock/virtio: account only unread bytes in read_skb()

[sashiko-bot@kernel.org]

> After a partial stream receive, rx_bytes tracks the unread suffix while
> buf_used and peer credit still cover the whole packet.
> virtio_transport_read_skb() dequeues that packet but passes pkt_len for
> both counters, underflowing rx_bytes.
> 
> On a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte read
> from a 100-byte packet made SIOCINQ report -40, an empty recv return
> ELOOP, and poll report the empty socket readable.  After verdict detach,
> receiving 40 bytes wrapped the counter to zero and hid those queued bytes
> until one more byte arrived.  The fixed run kept the counter balanced
> and exposed all queued data immediately.
> 
> This was found during an LLM-assisted manual source audit of VSOCK
> receive accounting while re-evaluating virtio_transport_read_skb() after
> CVE-2024-50169.
> 
> Subtract only skb->len minus the VSOCK offset from rx_bytes.  Retain the
> full packet length for buf_used and peer credit.
> 
> Fixes: 45ca7e9f0730 ("vsock/virtio: fix `rx_bytes` accounting for stream sockets")
> Cc: stable@vger.kernel.org
> Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001151310.4101006-1-4ncienth@gmail.com?part=1