On Wed, Dec 17, 2025 at 07:12:03PM +0100, Melbin K Mathew wrote:
The credit calculation in virtio_transport_get_credit() uses unsigned
arithmetic:
ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes
are in flight, the subtraction can underflow and produce a large
positive value, potentially allowing more data to be queued than the
peer can handle.
Use s64 arithmetic for the subtraction and clamp negative results to
zero, matching the approach already used in virtio_transport_has_space().
Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko")
Suggested-by: Stefano Garzarella <[email protected]>
Signed-off-by: Melbin K Mathew <[email protected]>
---
net/vmw_vsock/virtio_transport_common.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/net/vmw_vsock/virtio_transport_common.c
b/net/vmw_vsock/virtio_transport_common.c
index dcc8a1d5851e..d692b227912d 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -494,14 +494,25 @@ EXPORT_SYMBOL_GPL(virtio_transport_consume_skb_sent);
u32 virtio_transport_get_credit(struct virtio_vsock_sock *vvs, u32 credit)
{
u32 ret;
+ u32 inflight;
+ s64 bytes;
if (!credit)
return 0;
spin_lock_bh(&vvs->tx_lock);
- ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);
- if (ret > credit)
- ret = credit;
+
+ /*
+ * Compute available space using s64 to avoid underflow if
+ * peer_buf_alloc < inflight bytes (can happen if peer shrinks
+ * its advertised buffer while data is in flight).
+ */
+ inflight = vvs->tx_cnt - vvs->peer_fwd_cnt;
+ bytes = (s64)vvs->peer_buf_alloc - inflight;
I'm really confused, in our previous discussion we agreed on re-using
virtio_transport_has_space(), what changend in the mean time?
Stefano
+ if (bytes < 0)
+ bytes = 0;
+
+ ret = (bytes > credit) ? credit : (u32)bytes;
vvs->tx_cnt += ret;
vvs->bytes_unsent += ret;
spin_unlock_bh(&vvs->tx_lock);
--
2.34.1
