[PATCH 6.12 164/169] vsock/virtio: Move SKB allocation lower-bound check to callers

Greg Kroah-Hartman
2026-01-28T15:49:44Z

From: Will Deacon <will@kernel.org>

[Upstream commit fac6b82e0f3eaca33c8c67ec401681b21143ae17]

virtio_vsock_alloc_linear_skb() checks that the requested size is at
least big enough for the packet header (VIRTIO_VSOCK_SKB_HEADROOM).

Of the three callers of virtio_vsock_alloc_linear_skb(), only
vhost_vsock_alloc_skb() can potentially pass a packet smaller than the
header size and, as it already has a check against the maximum packet
size, extend its bounds checking to consider the minimum packet size
and remove the check from virtio_vsock_alloc_linear_skb().

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Will Deacon <will@kernel.org>
Message-Id: <20250717090116.11987-7-will@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vhost/vsock.c | 3 ++-
include/linux/virtio_vsock.h | 3 ---
2 files changed, 2 insertions(+), 4 deletions(-)

--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -345,7 +345,8 @@ vhost_vsock_alloc_skb(struct vhost_virtq

len = iov_length(vq->iov, out);

- if (len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM)
+ if (len < VIRTIO_VSOCK_SKB_HEADROOM ||
+ len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM)
return NULL;

/* len contains both payload and hdr */
--- a/include/linux/virtio_vsock.h
+++ b/include/linux/virtio_vsock.h
@@ -57,9 +57,6 @@ virtio_vsock_alloc_linear_skb(unsigned i
{
struct sk_buff *skb;

- if (size < VIRTIO_VSOCK_SKB_HEADROOM)
- return NULL;
-
skb = alloc_skb(size, mask);
if (!skb)
return NULL;