* [PATCH net] vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
@ 2026-10-07 14:37 Ilia Gavrilov
2026-10-07 14:53 ` sashiko-bot
2026-10-08 10:16 ` Stefano Garzarella
0 siblings, 2 replies; 4+ messages in thread
From: Ilia Gavrilov @ 2026-10-07 14:37 UTC (permalink / raw)
To: Stefano Garzarella
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, George Zhang, Dmitry Torokhov, Andy King,
virtualization@lists.linux.dev, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
During the closure of a datagram socket, the vmci_transport_recv_dgram_cb()
function may be called, which will add the packets
to the socket's backlog; then, after the receive queue is cleared,
the __release_sock() function will move the packet back from the socket's
backlog to the receive queue, which will lead to a memory leak.
sock_close
__sock_release
__vsock_release
// take ownership by user-space
lock_sock_nested
sock_set_flag(sk, SOCK_DEAD)
vmci_transport_release
vmci_dispatch_dgs
vmci_datagram_invoke_guest_handler
vmci_transport_recv_dgram_cb
sk_receive_skb
if (!sock_owned_by_user(sk))
[...]
(!) else if sk_add_backlog()
[...]
(!) skb_queue_purge(&sk->sk_receive_queue)
release_sock
__release_sock
// move all packets from the backlog
// to the receive queue
(!) sk_backlog_rcv
vsock_queue_rcv_skb
[...]
__sock_queue_rcv_skb
if (!sock_flag(sk, SOCK_DEAD))
// Since the socket is "dead", the function will not
// be called
sk->sk_data_ready(sk)
sock_release_ownership(sk);
sock_put
Add a receive queue cleanup in the socket destructor to fix this.
syzkaller report:
unreferenced object 0xffff8880117bfb80 (size 240):
comm "irq/56-vmw_vmci", pid 205, jiffies 4295064448 (age 73.992s)
hex dump (first 32 bytes):
78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&.....
00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&.....
backtrace:
[<ffffffff82be8d97>] __alloc_skb+0x287/0x330 net/core/skbuff.c:505
[<ffffffffa114bcbd>] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]
[<ffffffffa05072c6>] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]
[<ffffffffa050ad75>] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]
[<ffffffffa050b025>] vmci_interrupt+0x55/0x290 [vmw_vmci]
[<ffffffff8137ad2b>] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205
[<ffffffff8137c7ae>] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314
[<ffffffff81253dd6>] kthread+0x2e6/0x3a0 kernel/kthread.c:376
[<ffffffff81004392>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller.
Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
---
net/vmw_vsock/af_vsock.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 9b71479a2b29..fbafd882a12c 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1048,6 +1048,7 @@ static void vsock_sk_destruct(struct sock *sk)
{
struct vsock_sock *vsk = vsock_sk(sk);
+ __skb_queue_purge(&sk->sk_receive_queue);
/* Flush MSG_ZEROCOPY leftovers. */
__skb_queue_purge(&sk->sk_error_queue);
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net] vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
2026-10-07 14:37 [PATCH net] vsock: Fix memory leak in vmci_transport_recv_dgram_cb() Ilia Gavrilov
@ 2026-10-07 14:53 ` sashiko-bot
2026-10-08 10:16 ` Stefano Garzarella
1 sibling, 0 replies; 4+ messages in thread
From: sashiko-bot @ 2026-10-07 14:53 UTC (permalink / raw)
To: Ilia Gavrilov; +Cc: virtualization, Eugenio Perez, Michael S. Tsirkin
> During the closure of a datagram socket, the vmci_transport_recv_dgram_cb()
> function may be called, which will add the packets
> to the socket's backlog; then, after the receive queue is cleared,
> the __release_sock() function will move the packet back from the socket's
> backlog to the receive queue, which will lead to a memory leak.
>
> sock_close
> __sock_release
> __vsock_release
> // take ownership by user-space
> lock_sock_nested
> sock_set_flag(sk, SOCK_DEAD)
> vmci_transport_release
> vmci_dispatch_dgs
> vmci_datagram_invoke_guest_handler
> [ ... ]
> Found by InfoTeCS on behalf of Linux Verification Center
> (linuxtesting.org) with Syzkaller.
>
> Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
> Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261007143716.1984702-1-Ilia.Gavrilov@infotecs.ru?part=1
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net] vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
2026-10-07 14:37 [PATCH net] vsock: Fix memory leak in vmci_transport_recv_dgram_cb() Ilia Gavrilov
2026-10-07 14:53 ` sashiko-bot
@ 2026-10-08 10:16 ` Stefano Garzarella
1 sibling, 0 replies; 4+ messages in thread
From: Stefano Garzarella @ 2026-10-08 10:16 UTC (permalink / raw)
To: Ilia Gavrilov
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, George Zhang, Dmitry Torokhov, Andy King,
virtualization@lists.linux.dev, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
On Wed, Oct 07, 2026 at 02:37:47PM +0000, Ilia Gavrilov wrote:
>During the closure of a datagram socket, the vmci_transport_recv_dgram_cb()
>function may be called, which will add the packets
>to the socket's backlog; then, after the receive queue is cleared,
>the __release_sock() function will move the packet back from the socket's
>backlog to the receive queue, which will lead to a memory leak.
>
>sock_close
> __sock_release
> __vsock_release
> // take ownership by user-space
> lock_sock_nested
> sock_set_flag(sk, SOCK_DEAD)
> vmci_transport_release
> vmci_dispatch_dgs
> vmci_datagram_invoke_guest_handler
> vmci_transport_recv_dgram_cb
> sk_receive_skb
> if (!sock_owned_by_user(sk))
> [...]
> (!) else if sk_add_backlog()
> [...]
> (!) skb_queue_purge(&sk->sk_receive_queue)
>
> release_sock
> __release_sock
> // move all packets from the backlog
> // to the receive queue
> (!) sk_backlog_rcv
> vsock_queue_rcv_skb
> [...]
> __sock_queue_rcv_skb
> if (!sock_flag(sk, SOCK_DEAD))
> // Since the socket is "dead", the function will not
> // be called
> sk->sk_data_ready(sk)
> sock_release_ownership(sk);
> sock_put
>
>Add a receive queue cleanup in the socket destructor to fix this.
>
>syzkaller report:
>
>unreferenced object 0xffff8880117bfb80 (size 240):
> comm "irq/56-vmw_vmci", pid 205, jiffies 4295064448 (age 73.992s)
> hex dump (first 32 bytes):
> 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&.....
> 00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&.....
> backtrace:
> [<ffffffff82be8d97>] __alloc_skb+0x287/0x330 net/core/skbuff.c:505
> [<ffffffffa114bcbd>] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]
> [<ffffffffa05072c6>] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]
> [<ffffffffa050ad75>] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]
> [<ffffffffa050b025>] vmci_interrupt+0x55/0x290 [vmw_vmci]
> [<ffffffff8137ad2b>] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205
> [<ffffffff8137c7ae>] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314
> [<ffffffff81253dd6>] kthread+0x2e6/0x3a0 kernel/kthread.c:376
> [<ffffffff81004392>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
>
>Found by InfoTeCS on behalf of Linux Verification Center
>(linuxtesting.org) with Syzkaller.
>
>Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
>Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
>---
> net/vmw_vsock/af_vsock.c | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
>index 9b71479a2b29..fbafd882a12c 100644
>--- a/net/vmw_vsock/af_vsock.c
>+++ b/net/vmw_vsock/af_vsock.c
>@@ -1048,6 +1048,7 @@ static void vsock_sk_destruct(struct sock *sk)
> {
> struct vsock_sock *vsk = vsock_sk(sk);
>
nit: maybe a comment here referring to vmci datagram could be nice to
have if you send a v2. In any case, also this version is fine to me:
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
>+ __skb_queue_purge(&sk->sk_receive_queue);
> /* Flush MSG_ZEROCOPY leftovers. */
> __skb_queue_purge(&sk->sk_error_queue);
>
>--
>2.47.3
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH net] vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
@ 2026-10-08 14:38 Ilia Gavrilov
0 siblings, 0 replies; 4+ messages in thread
From: Ilia Gavrilov @ 2026-10-08 14:38 UTC (permalink / raw)
To: Stefano Garzarella
Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, George Zhang, Dmitry Torokhov, Andy King,
virtualization@lists.linux.dev, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
During the closure of a datagram socket, the vmci_transport_recv_dgram_cb()
function may be called, which will add the packets
to the socket's backlog; then, after the receive queue is cleared,
the __release_sock() function will move the packet back from the socket's
backlog to the receive queue, which will lead to a memory leak.
sock_close
__sock_release
__vsock_release
// take ownership by user-space
lock_sock_nested
sock_set_flag(sk, SOCK_DEAD)
vmci_transport_release
vmci_dispatch_dgs
vmci_datagram_invoke_guest_handler
vmci_transport_recv_dgram_cb
sk_receive_skb
if (!sock_owned_by_user(sk))
[...]
(!) else if sk_add_backlog()
[...]
(!) skb_queue_purge(&sk->sk_receive_queue)
release_sock
__release_sock
// move all packets from the backlog
// to the receive queue
(!) sk_backlog_rcv
vsock_queue_rcv_skb
[...]
__sock_queue_rcv_skb
if (!sock_flag(sk, SOCK_DEAD))
// Since the socket is "dead", the function will not
// be called
sk->sk_data_ready(sk)
sock_release_ownership(sk);
sock_put
Add a receive queue cleanup in the socket destructor to fix this.
syzkaller report:
unreferenced object 0xffff8880117bfb80 (size 240):
comm "irq/56-vmw_vmci", pid 205, jiffies 4295064448 (age 73.992s)
hex dump (first 32 bytes):
78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&.....
00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&.....
backtrace:
[<ffffffff82be8d97>] __alloc_skb+0x287/0x330 net/core/skbuff.c:505
[<ffffffffa114bcbd>] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]
[<ffffffffa05072c6>] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]
[<ffffffffa050ad75>] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]
[<ffffffffa050b025>] vmci_interrupt+0x55/0x290 [vmw_vmci]
[<ffffffff8137ad2b>] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205
[<ffffffff8137c7ae>] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314
[<ffffffff81253dd6>] kthread+0x2e6/0x3a0 kernel/kthread.c:376
[<ffffffff81004392>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller.
Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
---
net/vmw_vsock/af_vsock.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 9b71479a2b29..fbafd882a12c 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1048,6 +1048,7 @@ static void vsock_sk_destruct(struct sock *sk)
{
struct vsock_sock *vsk = vsock_sk(sk);
+ __skb_queue_purge(&sk->sk_receive_queue);
/* Flush MSG_ZEROCOPY leftovers. */
__skb_queue_purge(&sk->sk_error_queue);
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-08 14:38 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-07 14:37 [PATCH net] vsock: Fix memory leak in vmci_transport_recv_dgram_cb() Ilia Gavrilov
2026-10-07 14:53 ` sashiko-bot
2026-10-08 10:16 ` Stefano Garzarella
-- strict thread matches above, loose matches on Subject: below --
2026-10-08 14:38 Ilia Gavrilov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox