Re: [PATCH net v2] vhost/vsock: size receive SKBs from declared payload

[sashiko-bot@kernel.org]

> vhost_vsock_alloc_skb() allocates an skb from the total guest descriptor
> length before reading hdr->len.  Descriptor capacity and declared payload
> length are independent, so a guest can supply a large descriptor with a
> zero or short payload.
> 
> On Linux v7.2, 455 zero-payload packets with 64 KiB descriptors retained
> 30,255,680 bytes on a 256 KiB receive buffer while rx_bytes and buf_used
> stayed zero.  A full-payload control retained 265,984 bytes.  The existing
> SKB_TRUESIZE(0) budget caps skb count but does not account for the
> descriptor-sized allocation.
> 
> Repeating this across connections can exhaust host kernel memory.
> 
> Trimming after allocation is insufficient.  Linear skbs retain their full
> head, while a nonlinear payload exceeding head tailroom can retain its
> first page fragment.
> 
> Copy the header into a stack object, validate hdr->len before allocating,
> and size the skb from the declared payload plus the header.  This keeps the
> allocation proportional to receive accounting for both linear and
> nonlinear skbs.
> 
> Use payload_len > len - sizeof(hdr) for validation.  This avoids addition
> overflow on 32-bit hosts and ensures payload_len fits the subsequent
> int-length copy path.
> 
> Fixes: ab9aa2f3afc2 ("vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261004073419.4039011-1-4ncienth@gmail.com?part=1