> vhost_vsock_alloc_skb() sizes its skb from the total guest descriptor
> length, while virtio_vsock_hdr.len independently declares the payload
> length. Since commit ab9aa2f3afc2 ("vhost/vsock: Allocate nonlinear SKBs
> for handling large receive buffers"), large descriptors use skb fragments.
>
> virtio_vsock_skb_put() currently changes only skb->len for a nonlinear
> skb, leaving skb->data_len and all fragments attached. The zero-payload
> fast path skips the helper entirely. A guest can therefore retain the
> full descriptor allocation while receive credit accounts no payload.
>
> On Linux v7.2, 455 zero-payload skbs retained 30,255,680 bytes on a
> 256 KiB receive buffer while rx_bytes and buf_used remained zero. A
> full-payload control retained 265,984 bytes in four skbs. The existing
> SKB_TRUESIZE(0) queue budget caps skb count but does not account for these
> descriptor-sized fragments.
> [ ... ]
>
> Fixes: ab9aa2f3afc2 ("vhost/vsock: Allocate nonlinear SKBs for handling large
> receive buffers")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
