`virtio_transport_stream_do_peek`, when calculating the number of bytes to copy, didn't consider the `offset`, caused by partial reads that happened before. This might cause out-of-bounds read that lead to an EFAULT. More details in the commits.
Commit 1 introduces the fix Commit 2 introduces some preliminary work for adding a test and fixes a problem in existing tests. Commit 3 introduces a test that checks for this bug to avoid future regressions. For disclosure: this bug was found initially by claude opus 4.6, I then analzyed it and worked on the fix and the test. Signed-off-by: Luigi Leonardi <[email protected]> --- Changes in v3: - Addressed reviwers omment - Dropped test client, reusing the one already existing - Minor changes: added comment, improved commit messages - Rebased to latest net-next - Link to v2: https://lore.kernel.org/r/[email protected] Changes in v2: - Addressed reviewers comment - Test now uses the recv_buf utils. - Removed unnecessary barrier - Checkpatch warnings. - Added new commit that allows to use recv_buf with MSG_PEEK - Picked up RoBs - Link to v1: https://lore.kernel.org/r/[email protected] --- Luigi Leonardi (3): vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy vsock/test: fix MSG_PEEK handling in recv_buf() vsock/test: add MSG_PEEK after partial recv test net/vmw_vsock/virtio_transport_common.c | 5 ++-- tools/testing/vsock/util.c | 15 ++++++++++ tools/testing/vsock/vsock_test.c | 50 +++++++++++++++++++++++++-------- 3 files changed, 55 insertions(+), 15 deletions(-) --- base-commit: bc28831d7a09f7058cdca4658d81e5faf635bed7 change-id: 20260401-fix_peek-6837b83469e3 Best regards, -- Luigi Leonardi <[email protected]>
