On Wed, Dec 17, 2025 at 07:12:03PM +0100, Melbin K Mathew wrote:
>The credit calculation in virtio_transport_get_credit() uses unsigned
>arithmetic:
>
> ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
>
>If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes
>are in flight, the subtraction can underflow and produce a large
>positive value, potentially allowing more data to be queued than the
>peer can handle.
>
>Use s64 arithmetic for the subtraction and clamp negative results to
>zero, matching the approach already used in virtio_transport_has_space().
>
>Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko")
>Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
>Signed-off-by: Melbin K Mathew <mlbnkm1@gmail.com>
>---
> net/vmw_vsock/virtio_transport_common.c | 17 ++++++++++++++---
> 1 file changed, 14 insertions(+), 3 deletions(-)
>
>diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
>index dcc8a1d5851e..d692b227912d 100644
>--- a/net/vmw_vsock/virtio_transport_common.c
>+++ b/net/vmw_vsock/virtio_transport_common.c
>@@ -494,14 +494,25 @@ EXPORT_SYMBOL_GPL(virtio_transport_consume_skb_sent);
> u32 virtio_transport_get_credit(struct virtio_vsock_sock *vvs, u32 credit)
> {
> u32 ret;
>+ u32 inflight;
>+ s64 bytes;
>
> if (!credit)
> return 0;
>
> spin_lock_bh(&vvs->tx_lock);
>- ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
>- if (ret > credit)
>- ret = credit;
>+
>+ /*
>+ * Compute available space using s64 to avoid underflow if
>+ * peer_buf_alloc < inflight bytes (can happen if peer shrinks
>+ * its advertised buffer while data is in flight).
>+ */
>+ inflight = vvs->tx_cnt - vvs->peer_fwd_cnt;
>+ bytes = (s64)vvs->peer_buf_alloc - inflight;
I'm really confused, in our previous discussion we agreed on re-using
virtio_transport_has_space(), what changend in the mean time?
Stefano
>+ if (bytes < 0)
>+ bytes = 0;
>+
>+ ret = (bytes > credit) ? credit : (u32)bytes;
> vvs->tx_cnt += ret;
> vvs->bytes_unsent += ret;
> spin_unlock_bh(&vvs->tx_lock);
>--
>2.34.1
>