+Cc Will that touched this code recently
On Wed, Sep 30, 2026 at 01:41:45PM +0900, Daehyeon Ko wrote:
vhost_vsock_alloc_skb() sizes its skb from the total guest descriptor
length, while virtio_vsock_hdr.len independently declares the payload
length. Since commit ab9aa2f3afc2 ("vhost/vsock: Allocate nonlinear SKBs
for handling large receive buffers"), large descriptors use skb fragments.
virtio_vsock_skb_put() currently changes only skb->len for a nonlinear
skb, leaving skb->data_len and all fragments attached. The zero-payload
fast path skips the helper entirely. A guest can therefore retain the
full descriptor allocation while receive credit accounts no payload.
On Linux v7.2, 455 zero-payload skbs retained 30,255,680 bytes on a
256 KiB receive buffer while rx_bytes and buf_used remained zero. A
full-payload control retained 265,984 bytes in four skbs. The existing
SKB_TRUESIZE(0) queue budget caps skb count but does not account for these
descriptor-sized fragments.
Set skb->len to the fragment length before calling pskb_trim(), then trim
to the declared payload length. This releases unused fragments and lets
skb_condense() reduce truesize. Move the zero-payload return after the
helper so zero-length packets are trimmed too.
These skbs are newly allocated, unique, and have no frag_list, so the trim
does not enter an allocation-bearing path. Keep a warning for a violated
caller contract.
The fixed v7.2 image left a one-byte skb with no fragments and reduced
the zero-payload queue to one 960-byte skb. The build had no compiler
warnings, and the run had no sanitizer, WARN, oops, or panic findings.
I think this is a requirement for every patch sent, no?
Why putting in the commit message?
Fixes: ab9aa2f3afc2 ("vhost/vsock: Allocate nonlinear SKBs for handling large
receive buffers")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <[email protected]>
---
Required configuration is CONFIG_VSOCKETS, CONFIG_VIRTIO_VSOCKETS_COMMON,
and CONFIG_VHOST_VSOCK.
The source reproducer is available privately to maintainers and is
omitted from this public AI-assisted report. It exercises the real
allocation helper and VSOCK receive queue from an in-kernel module, not
a live guest virtqueue. Guest control is source-confirmed, but live guest
end-to-end validation and deliberate host OOM were not performed. No KASAN
splat is expected or claimed; the oracle is retained truesize and receive
credit state above.
drivers/vhost/vsock.c | 6 ++----
include/linux/virtio_vsock.h | 9 ++++++---
2 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index abed1fbcf66c..fa59456abda9 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -400,10 +400,6 @@ vhost_vsock_alloc_skb(struct vhost_virtqueue *vq,
payload_len = le32_to_cpu(hdr->len);
- /* No payload */
- if (!payload_len)
- return skb;
-
/* The pkt is too big or the length in the header is invalid */
if (payload_len + sizeof(*hdr) > len) {
kfree_skb(skb);
@@ -411,6 +407,8 @@ vhost_vsock_alloc_skb(struct vhost_virtqueue *vq,
}
virtio_vsock_skb_put(skb, payload_len);
+ if (!payload_len)
+ return skb;
if (skb_copy_datagram_from_iter(skb, 0, &iov_iter, payload_len)) {
vq_err(vq, "Failed to copy %zu byte payload\n", payload_len);
diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h
index f91704731057..31358683e23e 100644
--- a/include/linux/virtio_vsock.h
+++ b/include/linux/virtio_vsock.h
@@ -51,10 +51,13 @@ static inline void virtio_vsock_skb_put(struct sk_buff
*skb, u32 len)
{
DEBUG_NET_WARN_ON_ONCE(skb->len);
- if (skb_is_nonlinear(skb))
- skb->len = len;
- else
+ if (skb_is_nonlinear(skb)) {
Would be nice to have a comment here to explain better the reason we are
doing this.
Thanks,
Stefano
+ skb->len = skb->data_len;
+ if (WARN_ON_ONCE(pskb_trim(skb, len)))
+ return;
+ } else {
skb_put(skb, len);
+ }
}
static inline struct sk_buff *
base-commit: 54518e0e827f4ca9229ae657022c60bf60f5c1bf
--
2.55.0
