* [PATCH] vsock/virtio: fix potential unbounded skb queue
@ 2026-05-15 14:22 Luigi Leonardi
2026-05-15 14:23 ` Luigi Leonardi
2026-05-15 15:31 ` Michael S. Tsirkin
0 siblings, 2 replies; 5+ messages in thread
From: Luigi Leonardi @ 2026-05-15 14:22 UTC (permalink / raw)
To: stable
Cc: Luigi Leonardi, Stefano Garzarella, Eric Dumazet, Arseniy Krasnov,
Stefan Hajnoczi, Michael S. Tsirkin, Jason Wang, Xuan Zhuo,
Eugenio Pérez, virtualization, Jakub Kicinski
From: Eric Dumazet <edumazet@google.com>
Upstream commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5
virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.
virtio_transport_recv_enqueue() skips coalescing for packets
with VIRTIO_VSOCK_SEQ_EOM.
If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM,
a very large number of packets can be queued
because vvs->rx_bytes stays at 0.
Fix this by estimating the skb metadata size:
(Number of skbs in the queue) * SKB_TRUESIZE(0)
Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Cc: Eugenio Pérez <eperezma@redhat.com>
Cc: virtualization@lists.linux.dev
Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[LL: Fixed conflict since this tree does not use buf_used added by commit
45ca7e9f0730 ("vsock/virtio: fix `rx_bytes` accounting for stream sockets")]
Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
---
net/vmw_vsock/virtio_transport_common.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 4c374c36c29d..86e3051d000e 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -283,7 +283,9 @@ static int virtio_transport_send_pkt_info(struct vsock_sock *vsk,
static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs,
u32 len)
{
- if (vvs->rx_bytes + len > vvs->buf_alloc)
+ u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0);
+
+ if (skb_overhead + vvs->rx_bytes + len > vvs->buf_alloc)
return false;
vvs->rx_bytes += len;
---
base-commit: 3b9f64db049687c0d38b4b3ef2f297f0642179af
change-id: 20260515-dumazet-07c0c855a9e2
Best regards,
--
Luigi Leonardi <leonardi@redhat.com>
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] vsock/virtio: fix potential unbounded skb queue
2026-05-15 14:22 [PATCH] vsock/virtio: fix potential unbounded skb queue Luigi Leonardi
@ 2026-05-15 14:23 ` Luigi Leonardi
2026-05-15 15:10 ` Greg KH
2026-05-15 15:31 ` Michael S. Tsirkin
1 sibling, 1 reply; 5+ messages in thread
From: Luigi Leonardi @ 2026-05-15 14:23 UTC (permalink / raw)
To: stable
Cc: Stefano Garzarella, Eric Dumazet, Arseniy Krasnov,
Stefan Hajnoczi, Michael S. Tsirkin, Jason Wang, Xuan Zhuo,
Eugenio Pérez, virtualization, Jakub Kicinski
On Fri, May 15, 2026 at 04:22:12PM +0200, Luigi Leonardi wrote:
>From: Eric Dumazet <edumazet@google.com>
>
>Upstream commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5
>
>virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.
>
>virtio_transport_recv_enqueue() skips coalescing for packets
>with VIRTIO_VSOCK_SEQ_EOM.
>
>If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM,
>a very large number of packets can be queued
>because vvs->rx_bytes stays at 0.
>
>Fix this by estimating the skb metadata size:
>
> (Number of skbs in the queue) * SKB_TRUESIZE(0)
>
>Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit")
>Signed-off-by: Eric Dumazet <edumazet@google.com>
>Cc: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
>Cc: Stefan Hajnoczi <stefanha@redhat.com>
>Cc: Stefano Garzarella <sgarzare@redhat.com>
>Cc: Michael S. Tsirkin <mst@redhat.com>
>Cc: Jason Wang <jasowang@redhat.com>
>Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
>Cc: Eugenio Pérez <eperezma@redhat.com>
>Cc: virtualization@lists.linux.dev
>Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com
>Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>[LL: Fixed conflict since this tree does not use buf_used added by commit
> 45ca7e9f0730 ("vsock/virtio: fix `rx_bytes` accounting for stream sockets")]
>Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
>---
> net/vmw_vsock/virtio_transport_common.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
>diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
>index 4c374c36c29d..86e3051d000e 100644
>--- a/net/vmw_vsock/virtio_transport_common.c
>+++ b/net/vmw_vsock/virtio_transport_common.c
>@@ -283,7 +283,9 @@ static int virtio_transport_send_pkt_info(struct vsock_sock *vsk,
> static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs,
> u32 len)
> {
>- if (vvs->rx_bytes + len > vvs->buf_alloc)
>+ u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0);
>+
>+ if (skb_overhead + vvs->rx_bytes + len > vvs->buf_alloc)
> return false;
>
> vvs->rx_bytes += len;
>
>---
>base-commit: 3b9f64db049687c0d38b4b3ef2f297f0642179af
>change-id: 20260515-dumazet-07c0c855a9e2
>
>Best regards,
>--
>Luigi Leonardi <leonardi@redhat.com>
>
Forgot to add this is material for 6.6.y stable tree.
Luigi
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] vsock/virtio: fix potential unbounded skb queue
2026-05-15 14:23 ` Luigi Leonardi
@ 2026-05-15 15:10 ` Greg KH
2026-05-15 15:11 ` Greg KH
0 siblings, 1 reply; 5+ messages in thread
From: Greg KH @ 2026-05-15 15:10 UTC (permalink / raw)
To: Luigi Leonardi
Cc: stable, Stefano Garzarella, Eric Dumazet, Arseniy Krasnov,
Stefan Hajnoczi, Michael S. Tsirkin, Jason Wang, Xuan Zhuo,
Eugenio Pérez, virtualization, Jakub Kicinski
On Fri, May 15, 2026 at 04:23:53PM +0200, Luigi Leonardi wrote:
> On Fri, May 15, 2026 at 04:22:12PM +0200, Luigi Leonardi wrote:
> > From: Eric Dumazet <edumazet@google.com>
> >
> > Upstream commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5
> >
> > virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.
> >
> > virtio_transport_recv_enqueue() skips coalescing for packets
> > with VIRTIO_VSOCK_SEQ_EOM.
> >
> > If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM,
> > a very large number of packets can be queued
> > because vvs->rx_bytes stays at 0.
> >
> > Fix this by estimating the skb metadata size:
> >
> > (Number of skbs in the queue) * SKB_TRUESIZE(0)
> >
> > Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit")
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > Cc: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
> > Cc: Stefan Hajnoczi <stefanha@redhat.com>
> > Cc: Stefano Garzarella <sgarzare@redhat.com>
> > Cc: Michael S. Tsirkin <mst@redhat.com>
> > Cc: Jason Wang <jasowang@redhat.com>
> > Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
> > Cc: Eugenio Pérez <eperezma@redhat.com>
> > Cc: virtualization@lists.linux.dev
> > Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com
> > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> > [LL: Fixed conflict since this tree does not use buf_used added by commit
> > 45ca7e9f0730 ("vsock/virtio: fix `rx_bytes` accounting for stream sockets")]
> > Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
> > ---
> > net/vmw_vsock/virtio_transport_common.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
> > index 4c374c36c29d..86e3051d000e 100644
> > --- a/net/vmw_vsock/virtio_transport_common.c
> > +++ b/net/vmw_vsock/virtio_transport_common.c
> > @@ -283,7 +283,9 @@ static int virtio_transport_send_pkt_info(struct vsock_sock *vsk,
> > static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs,
> > u32 len)
> > {
> > - if (vvs->rx_bytes + len > vvs->buf_alloc)
> > + u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0);
> > +
> > + if (skb_overhead + vvs->rx_bytes + len > vvs->buf_alloc)
> > return false;
> >
> > vvs->rx_bytes += len;
> >
> > ---
> > base-commit: 3b9f64db049687c0d38b4b3ef2f297f0642179af
> > change-id: 20260515-dumazet-07c0c855a9e2
> >
> > Best regards,
> > --
> > Luigi Leonardi <leonardi@redhat.com>
> >
>
> Forgot to add this is material for 6.6.y stable tree.
What about all of the newer stable trees? You can't just apply a patch
to an old branch :(
thanks,
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] vsock/virtio: fix potential unbounded skb queue
2026-05-15 15:10 ` Greg KH
@ 2026-05-15 15:11 ` Greg KH
0 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2026-05-15 15:11 UTC (permalink / raw)
To: Luigi Leonardi
Cc: stable, Stefano Garzarella, Eric Dumazet, Arseniy Krasnov,
Stefan Hajnoczi, Michael S. Tsirkin, Jason Wang, Xuan Zhuo,
Eugenio Pérez, virtualization, Jakub Kicinski
On Fri, May 15, 2026 at 05:10:39PM +0200, Greg KH wrote:
> On Fri, May 15, 2026 at 04:23:53PM +0200, Luigi Leonardi wrote:
> > On Fri, May 15, 2026 at 04:22:12PM +0200, Luigi Leonardi wrote:
> > > From: Eric Dumazet <edumazet@google.com>
> > >
> > > Upstream commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5
> > >
> > > virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.
> > >
> > > virtio_transport_recv_enqueue() skips coalescing for packets
> > > with VIRTIO_VSOCK_SEQ_EOM.
> > >
> > > If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM,
> > > a very large number of packets can be queued
> > > because vvs->rx_bytes stays at 0.
> > >
> > > Fix this by estimating the skb metadata size:
> > >
> > > (Number of skbs in the queue) * SKB_TRUESIZE(0)
> > >
> > > Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit")
> > > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > > Cc: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
> > > Cc: Stefan Hajnoczi <stefanha@redhat.com>
> > > Cc: Stefano Garzarella <sgarzare@redhat.com>
> > > Cc: Michael S. Tsirkin <mst@redhat.com>
> > > Cc: Jason Wang <jasowang@redhat.com>
> > > Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
> > > Cc: Eugenio Pérez <eperezma@redhat.com>
> > > Cc: virtualization@lists.linux.dev
> > > Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com
> > > Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> > > [LL: Fixed conflict since this tree does not use buf_used added by commit
> > > 45ca7e9f0730 ("vsock/virtio: fix `rx_bytes` accounting for stream sockets")]
> > > Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
> > > ---
> > > net/vmw_vsock/virtio_transport_common.c | 4 +++-
> > > 1 file changed, 3 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
> > > index 4c374c36c29d..86e3051d000e 100644
> > > --- a/net/vmw_vsock/virtio_transport_common.c
> > > +++ b/net/vmw_vsock/virtio_transport_common.c
> > > @@ -283,7 +283,9 @@ static int virtio_transport_send_pkt_info(struct vsock_sock *vsk,
> > > static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs,
> > > u32 len)
> > > {
> > > - if (vvs->rx_bytes + len > vvs->buf_alloc)
> > > + u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0);
> > > +
> > > + if (skb_overhead + vvs->rx_bytes + len > vvs->buf_alloc)
> > > return false;
> > >
> > > vvs->rx_bytes += len;
> > >
> > > ---
> > > base-commit: 3b9f64db049687c0d38b4b3ef2f297f0642179af
> > > change-id: 20260515-dumazet-07c0c855a9e2
> > >
> > > Best regards,
> > > --
> > > Luigi Leonardi <leonardi@redhat.com>
> > >
> >
> > Forgot to add this is material for 6.6.y stable tree.
>
> What about all of the newer stable trees? You can't just apply a patch
> to an old branch :(
Ah, is this due to your other email? that makes more sense, sorry for
the noise.
greg "drowning in email" k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] vsock/virtio: fix potential unbounded skb queue
2026-05-15 14:22 [PATCH] vsock/virtio: fix potential unbounded skb queue Luigi Leonardi
2026-05-15 14:23 ` Luigi Leonardi
@ 2026-05-15 15:31 ` Michael S. Tsirkin
1 sibling, 0 replies; 5+ messages in thread
From: Michael S. Tsirkin @ 2026-05-15 15:31 UTC (permalink / raw)
To: Luigi Leonardi
Cc: stable, Stefano Garzarella, Eric Dumazet, Arseniy Krasnov,
Stefan Hajnoczi, Jason Wang, Xuan Zhuo, Eugenio Pérez,
virtualization, Jakub Kicinski
On Fri, May 15, 2026 at 04:22:12PM +0200, Luigi Leonardi wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> Upstream commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5
>
> virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.
>
> virtio_transport_recv_enqueue() skips coalescing for packets
> with VIRTIO_VSOCK_SEQ_EOM.
>
> If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM,
> a very large number of packets can be queued
> because vvs->rx_bytes stays at 0.
>
> Fix this by estimating the skb metadata size:
>
> (Number of skbs in the queue) * SKB_TRUESIZE(0)
>
> Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
> Cc: Stefan Hajnoczi <stefanha@redhat.com>
> Cc: Stefano Garzarella <sgarzare@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Jason Wang <jasowang@redhat.com>
> Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
> Cc: Eugenio Pérez <eperezma@redhat.com>
> Cc: virtualization@lists.linux.dev
> Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> [LL: Fixed conflict since this tree does not use buf_used added by commit
> 45ca7e9f0730 ("vsock/virtio: fix `rx_bytes` accounting for stream sockets")]
> Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
> ---
> net/vmw_vsock/virtio_transport_common.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
> index 4c374c36c29d..86e3051d000e 100644
> --- a/net/vmw_vsock/virtio_transport_common.c
> +++ b/net/vmw_vsock/virtio_transport_common.c
> @@ -283,7 +283,9 @@ static int virtio_transport_send_pkt_info(struct vsock_sock *vsk,
> static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs,
> u32 len)
> {
> - if (vvs->rx_bytes + len > vvs->buf_alloc)
> + u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0);
> +
> + if (skb_overhead + vvs->rx_bytes + len > vvs->buf_alloc)
> return false;
>
> vvs->rx_bytes += len;
>
> ---
> base-commit: 3b9f64db049687c0d38b4b3ef2f297f0642179af
> change-id: 20260515-dumazet-07c0c855a9e2
>
> Best regards,
> --
> Luigi Leonardi <leonardi@redhat.com>
I am not sure we should queue this for stable yet. It causes regressions
that we are now trying to fix.
--
MST
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-05-15 15:31 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-15 14:22 [PATCH] vsock/virtio: fix potential unbounded skb queue Luigi Leonardi
2026-05-15 14:23 ` Luigi Leonardi
2026-05-15 15:10 ` Greg KH
2026-05-15 15:11 ` Greg KH
2026-05-15 15:31 ` Michael S. Tsirkin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox