net/vmw_vsock/virtio_transport_common.c | 30 +++++-- tools/testing/vsock/vsock_test.c | 112 ++++++++++++++++++++++++ 2 files changed, 133 insertions(+), 9 deletions(-)
Resend with the right cc (sorry, a mistake on my env) The original series was posted by Melbin K Mathew <mlbnkm1@gmail.com> till v4: https://lore.kernel.org/netdev/20251217181206.3681159-1-mlbnkm1@gmail.com/ Since it's a real issue and the original author seems busy, I'm sending the v5 fixing my comments but keeping the authorship (and restoring mine on patch 2 as reported on v4). From Melbin K Mathew <mlbnkm1@gmail.com>: This series fixes TX credit handling in virtio-vsock: Patch 1: Fix potential underflow in get_credit() using s64 arithmetic Patch 2: Fix vsock_test seqpacket bounds test Patch 3: Cap TX credit to local buffer size (security hardening) Patch 4: Add stream TX credit bounds regression test The core issue is that a malicious guest can advertise a huge buffer size via SO_VM_SOCKETS_BUFFER_SIZE, causing the host to allocate excessive sk_buff memory when sending data to that guest. On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with 32 guest vsock connections advertising 2 GiB each and reading slowly drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only recovered after killing the QEMU process. With this series applied, the same PoC shows only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest remains responsive. Melbin K Mathew (3): vsock/virtio: fix potential underflow in virtio_transport_get_credit() vsock/virtio: cap TX credit to local buffer size vsock/test: add stream TX credit bounds test Stefano Garzarella (1): vsock/test: fix seqpacket message bounds test net/vmw_vsock/virtio_transport_common.c | 30 +++++-- tools/testing/vsock/vsock_test.c | 112 ++++++++++++++++++++++++ 2 files changed, 133 insertions(+), 9 deletions(-) -- 2.52.0
On Fri, 16 Jan 2026 21:15:13 +0100 Stefano Garzarella wrote: > Resend with the right cc (sorry, a mistake on my env) Please don't resend within 24h unless asked to: https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#tl-dr > The original series was posted by Melbin K Mathew <mlbnkm1@gmail.com> till > v4: https://lore.kernel.org/netdev/20251217181206.3681159-1-mlbnkm1@gmail.com/ > > Since it's a real issue and the original author seems busy, I'm sending > the v5 fixing my comments but keeping the authorship (and restoring mine > on patch 2 as reported on v4). Does not apply to net: Switched to a new branch 'vsock-virtio-fix-tx-credit-handling' Applying: vsock/virtio: fix potential underflow in virtio_transport_get_credit() Applying: vsock/test: fix seqpacket message bounds test Applying: vsock/virtio: cap TX credit to local buffer size Applying: vsock/test: add stream TX credit bounds test error: patch failed: tools/testing/vsock/vsock_test.c:2414 error: tools/testing/vsock/vsock_test.c: patch does not apply Patch failed at 0004 vsock/test: add stream TX credit bounds test hint: Use 'git am --show-current-patch=diff' to see the failed patch hint: When you have resolved this problem, run "git am --continue". hint: If you prefer to skip this patch, run "git am --skip" instead. hint: To restore the original branch and stop patching, run "git am --abort". hint: Disable this message with "git config set advice.mergeConflict false" Did you generate against net-next or there's some mid-air collision? (if the former please share the resolution for the resulting conflict;)) -- pw-bot: cr
On Mon, Jan 19, 2026 at 10:17:34AM -0800, Jakub Kicinski wrote:
>On Fri, 16 Jan 2026 21:15:13 +0100 Stefano Garzarella wrote:
>> Resend with the right cc (sorry, a mistake on my env)
>
>Please don't resend within 24h unless asked to:
>https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#tl-dr
Sorry for that, I'll avoid in the future.
>
>> The original series was posted by Melbin K Mathew <mlbnkm1@gmail.com> till
>> v4: https://lore.kernel.org/netdev/20251217181206.3681159-1-mlbnkm1@gmail.com/
>>
>> Since it's a real issue and the original author seems busy, I'm sending
>> the v5 fixing my comments but keeping the authorship (and restoring mine
>> on patch 2 as reported on v4).
>
>Does not apply to net:
>
>Switched to a new branch 'vsock-virtio-fix-tx-credit-handling'
>Applying: vsock/virtio: fix potential underflow in virtio_transport_get_credit()
>Applying: vsock/test: fix seqpacket message bounds test
>Applying: vsock/virtio: cap TX credit to local buffer size
>Applying: vsock/test: add stream TX credit bounds test
>error: patch failed: tools/testing/vsock/vsock_test.c:2414
>error: tools/testing/vsock/vsock_test.c: patch does not apply
>Patch failed at 0004 vsock/test: add stream TX credit bounds test
>hint: Use 'git am --show-current-patch=diff' to see the failed patch
>hint: When you have resolved this problem, run "git am --continue".
>hint: If you prefer to skip this patch, run "git am --skip" instead.
>hint: To restore the original branch and stop patching, run "git am --abort".
>hint: Disable this message with "git config set advice.mergeConflict false"
>
>Did you generate against net-next or there's some mid-air collision?
>(if the former please share the resolution for the resulting conflict;))
Ooops, a new test landed in net, this should be the resolution:
diff --cc tools/testing/vsock/vsock_test.c
index 668fbe9eb3cc,6933f986ef2a..000000000000
--- a/tools/testing/vsock/vsock_test.c
+++ b/tools/testing/vsock/vsock_test.c
@@@ -2414,11 -2510,11 +2510,16 @@@ static struct test_case test_cases[] =
.run_client = test_stream_accepted_setsockopt_client,
.run_server = test_stream_accepted_setsockopt_server,
},
+ {
+ .name = "SOCK_STREAM virtio MSG_ZEROCOPY coalescence corruption",
+ .run_client = test_stream_msgzcopy_mangle_client,
+ .run_server = test_stream_msgzcopy_mangle_server,
+ },
+ {
+ .name = "SOCK_STREAM TX credit bounds",
+ .run_client = test_stream_tx_credit_bounds_client,
+ .run_server = test_stream_tx_credit_bounds_server,
+ },
{},
};
If you prefer I can send a v6. In the mean time I pushed the branch
here:
https://github.com/stefano-garzarella/linux/tree/vsock_virtio_fix_tx_credit
Thanks,
Stefano
On Tue, 20 Jan 2026 10:37:12 +0100 Stefano Garzarella wrote: > If you prefer I can send a v6. We'll need a v6, patchwork can't do its thing if the series doesn't apply and last time I applied something without patchwork checks it broke selftest build: https://lore.kernel.org/all/20260120180319.1673271-1-kuba@kernel.org/ :(
On Tue, Jan 20, 2026 at 03:18:48PM -0800, Jakub Kicinski wrote: >On Tue, 20 Jan 2026 10:37:12 +0100 Stefano Garzarella wrote: >> If you prefer I can send a v6. > >We'll need a v6, patchwork can't do its thing if the series doesn't >apply and last time I applied something without patchwork checks it >broke selftest build: >https://lore.kernel.org/all/20260120180319.1673271-1-kuba@kernel.org/ >:( > Sure, not a problem at all, v6 is out now: https://lore.kernel.org/netdev/20260121093628.9941-1-sgarzare@redhat.com/ Thanks for the help! Stefano
© 2016 - 2026 Red Hat, Inc.