> vhost_vsock_alloc_skb() allocates an skb from the total guest descriptor
> length before reading hdr->len. Descriptor capacity and declared payload
> length are independent, so a guest can supply a large descriptor with a
> zero or short payload.
>
> On Linux v7.2, 455 zero-payload packets with 64 KiB descriptors retained
> 30,255,680 bytes on a 256 KiB receive buffer while rx_bytes and buf_used
> stayed zero. A full-payload control retained 265,984 bytes. The existing
> SKB_TRUESIZE(0) budget caps skb count but does not account for the
> descriptor-sized allocation.
>
> Repeating this across connections can exhaust host kernel memory.
>
> Trimming after allocation is insufficient. Linear skbs retain their full
> head, while a nonlinear payload exceeding head tailroom can retain its
> first page fragment.
>
> Copy the header into a stack object, validate hdr->len before allocating,
> and size the skb from the declared payload plus the header. This keeps the
> allocation proportional to receive accounting for both linear and
> nonlinear skbs.
>
> Use payload_len > len - sizeof(hdr) for validation. This avoids addition
> overflow on 32-bit hosts and ensures payload_len fits the subsequent
> int-length copy path.
>
> Fixes: ab9aa2f3afc2 ("vhost/vsock: Allocate nonlinear SKBs for handling large
> receive buffers")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
