02.04.2026 11:18, Luigi Leonardi wrote:
> `virtio_transport_stream_do_peek()` does not account for the skb offset
> when computing the number of bytes to copy.
>
> This means that, after a partial recv() that advances the offset, a peek
> requesting more bytes than are available in the sk_buff causes
> `skb_copy_datagram_iter()` to go past the valid payload, resulting in a
> -EFAULT.
>
> The dequeue path already handles this correctly.
> Apply the same logic to the peek path.
>
> Fixes: 0df7cd3c13e4 ("vsock/virtio/vhost: read data from non-linear skb")
> Signed-off-by: Luigi Leonardi <[email protected]>
> ---
> net/vmw_vsock/virtio_transport_common.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/net/vmw_vsock/virtio_transport_common.c
> b/net/vmw_vsock/virtio_transport_common.c
> index
> 8a9fb23c6e853dfea0a24d3787f7d6eb351dd6c6..4b65bfe5d875111f115e0fc4c6727adb66f34830
> 100644
> --- a/net/vmw_vsock/virtio_transport_common.c
> +++ b/net/vmw_vsock/virtio_transport_common.c
> @@ -547,9 +547,8 @@ virtio_transport_stream_do_peek(struct vsock_sock *vsk,
> skb_queue_walk(&vvs->rx_queue, skb) {
> size_t bytes;
>
> - bytes = len - total;
> - if (bytes > skb->len)
> - bytes = skb->len;
> + bytes = min_t(size_t, len - total,
> + skb->len - VIRTIO_VSOCK_SKB_CB(skb)->offset);
>
> spin_unlock_bh(&vvs->rx_lock);
>
>
Acked-by: Arseniy Krasnov <[email protected]>
