From nobody Tue Feb 10 04:16:57 2026 Received: from mailtransmit05.runbox.com (mailtransmit05.runbox.com [185.226.149.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 757DB43838E; Thu, 8 Jan 2026 09:55:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.226.149.38 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767866151; cv=none; b=d50LExh0a7nNHBiKAZMV+crY7lHBiCQ6VwRR4/gkQe+Y21//7VbxsAq4gInMl8XNIyR3mmWajYp2CW4q+RbWsrEb+DtCzntNuOQNfIMybee+1sgIzf4AqsMXUBLWsB+9Vwd6Wl1I+YQe1U8K9baoj9qmcVNbjZFeEtxUpLcdggw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767866151; c=relaxed/simple; bh=3jZ3PnY0rvRwje5pT8WFOnFUVsdmBIg6g8gCqqdjnXk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=RGiEMVM8xpsfN1Abxp+GI+cI8/O+RBkK2wcszaKiaA6bfOmISdt+R+fcaDASjAFl0sEO6M3wo2v0xCqN3sujWLNilDufGoEt1uAprBNqSXZa+tWMu2ikSp/X6jvdyfUsI1rSNvtsSDZq2cSSYn7oEzXOhFmwMtz3i9UP+T1nzro= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co; spf=pass smtp.mailfrom=rbox.co; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b=izlHfe2F; arc=none smtp.client-ip=185.226.149.38 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=rbox.co Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rbox.co Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rbox.co header.i=@rbox.co header.b="izlHfe2F" Received: from mailtransmit02.runbox ([10.9.9.162] helo=aibo.runbox.com) by mailtransmit05.runbox.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1vdmjp-0000fE-4k; Thu, 08 Jan 2026 10:55:29 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rbox.co; s=selector2; h=Cc:To:In-Reply-To:References:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From; bh=YpKDnmUVRDQ3EFb4NR3P8XxM1eDZ24y3Eu5jxeXe8E4=; b=izlHfe2FXrL341BQRbKcZ49gRl hesTB2RqKJ+7ZwBnW4CVkubzBMnnkxJjKo52Za/hefJN6tUKFKmoPM3BqzAMN2rvzR1UIs7CG/B+R qA7AOT8nqDyc9ZaD0C3/q2DIoCvBXUdXWsgOMxbvIZMLDO5lQeIZjsPBCQLtlIDObkCRoQHRPYW2q IFbMeBkjEj5j6BYXal6ocYlj+sVp7v9w8JKGQ/YOK90D1UKKoDl9wqvfBtk1BbYLbcUryv85BsgOe lYH82W6mpZBCEoxsA70HnN+kUY9lo5K92a9atdH110n+6u/EdR3UcvV3jhZPgr+0d7Huf3Xv6AN1S mLDV2HeQ==; Received: from [10.9.9.73] (helo=submission02.runbox) by mailtransmit02.runbox with esmtp (Exim 4.86_2) (envelope-from ) id 1vdmjo-0000eX-1W; Thu, 08 Jan 2026 10:55:28 +0100 Received: by submission02.runbox with esmtpsa [Authenticated ID (604044)] (TLS1.2:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.93) id 1vdmja-00AchK-O4; Thu, 08 Jan 2026 10:55:14 +0100 From: Michal Luczaj Date: Thu, 08 Jan 2026 10:54:55 +0100 Subject: [PATCH 2/2] vsock/test: Add test for a linear and non-linear skb getting coalesced Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260108-vsock-recv-coalescence-v1-2-26f97bb9a99b@rbox.co> References: <20260108-vsock-recv-coalescence-v1-0-26f97bb9a99b@rbox.co> In-Reply-To: <20260108-vsock-recv-coalescence-v1-0-26f97bb9a99b@rbox.co> To: "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?utf-8?q?Eugenio_P=C3=A9rez?= , Stefan Hajnoczi , Stefano Garzarella , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Arseniy Krasnov Cc: kvm@vger.kernel.org, virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Michal Luczaj X-Mailer: b4 0.14.3 Loopback transport can mangle data in rx queue when a linear skb is followed by a small MSG_ZEROCOPY packet. Signed-off-by: Michal Luczaj --- tools/testing/vsock/vsock_test.c | 5 +++ tools/testing/vsock/vsock_test_zerocopy.c | 67 +++++++++++++++++++++++++++= ++++ tools/testing/vsock/vsock_test_zerocopy.h | 3 ++ 3 files changed, 75 insertions(+) diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_t= est.c index bbe3723babdc..21c8616100f1 100644 --- a/tools/testing/vsock/vsock_test.c +++ b/tools/testing/vsock/vsock_test.c @@ -2403,6 +2403,11 @@ static struct test_case test_cases[] =3D { .run_client =3D test_stream_accepted_setsockopt_client, .run_server =3D test_stream_accepted_setsockopt_server, }, + { + .name =3D "SOCK_STREAM MSG_ZEROCOPY coalescence corruption", + .run_client =3D test_stream_msgzcopy_mangle_client, + .run_server =3D test_stream_msgzcopy_mangle_server, + }, {}, }; =20 diff --git a/tools/testing/vsock/vsock_test_zerocopy.c b/tools/testing/vsoc= k/vsock_test_zerocopy.c index 9d9a6cb9614a..6735a9d7525d 100644 --- a/tools/testing/vsock/vsock_test_zerocopy.c +++ b/tools/testing/vsock/vsock_test_zerocopy.c @@ -9,11 +9,13 @@ #include #include #include +#include #include #include #include #include #include +#include #include =20 #include "control.h" @@ -356,3 +358,68 @@ void test_stream_msgzcopy_empty_errq_server(const stru= ct test_opts *opts) control_expectln("DONE"); close(fd); } + +#define GOOD_COPY_LEN 128 /* net/vmw_vsock/virtio_transport_common.c */ + +void test_stream_msgzcopy_mangle_client(const struct test_opts *opts) +{ + char sbuf1[PAGE_SIZE + 1], sbuf2[GOOD_COPY_LEN]; + struct pollfd fds; + int fd; + + fd =3D vsock_stream_connect(opts->peer_cid, opts->peer_port); + if (fd < 0) { + perror("connect"); + exit(EXIT_FAILURE); + } + + enable_so_zerocopy_check(fd); + + memset(sbuf1, '1', sizeof(sbuf1)); + memset(sbuf2, '2', sizeof(sbuf2)); + + send_buf(fd, sbuf1, sizeof(sbuf1), 0, sizeof(sbuf1)); + send_buf(fd, sbuf2, sizeof(sbuf2), MSG_ZEROCOPY, sizeof(sbuf2)); + + fds.fd =3D fd; + fds.events =3D 0; + + if (poll(&fds, 1, -1) !=3D 1 || !(fds.revents & POLLERR)) { + perror("poll"); + exit(EXIT_FAILURE); + } + + close(fd); +} + +static void recv_verify(int fd, char *buf, unsigned int len, char pattern) +{ + recv_buf(fd, buf, len, 0, len); + + while (len--) { + if (*buf++ !=3D pattern) { + fprintf(stderr, "Incorrect data received\n"); + exit(EXIT_FAILURE); + } + } +} + +void test_stream_msgzcopy_mangle_server(const struct test_opts *opts) +{ + char rbuf[PAGE_SIZE + 1]; + int fd; + + fd =3D vsock_stream_accept(VMADDR_CID_ANY, opts->peer_port, NULL); + if (fd < 0) { + perror("accept"); + exit(EXIT_FAILURE); + } + + /* Wait, don't race the (buggy) skbs coalescence. */ + vsock_ioctl_int(fd, SIOCINQ, PAGE_SIZE + 1 + GOOD_COPY_LEN); + + recv_verify(fd, rbuf, PAGE_SIZE + 1, '1'); + recv_verify(fd, rbuf, GOOD_COPY_LEN, '2'); + + close(fd); +} diff --git a/tools/testing/vsock/vsock_test_zerocopy.h b/tools/testing/vsoc= k/vsock_test_zerocopy.h index 3ef2579e024d..d46c91a69f16 100644 --- a/tools/testing/vsock/vsock_test_zerocopy.h +++ b/tools/testing/vsock/vsock_test_zerocopy.h @@ -12,4 +12,7 @@ void test_seqpacket_msgzcopy_server(const struct test_opt= s *opts); void test_stream_msgzcopy_empty_errq_client(const struct test_opts *opts); void test_stream_msgzcopy_empty_errq_server(const struct test_opts *opts); =20 +void test_stream_msgzcopy_mangle_client(const struct test_opts *opts); +void test_stream_msgzcopy_mangle_server(const struct test_opts *opts); + #endif /* VSOCK_TEST_ZEROCOPY_H */ --=20 2.52.0