From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4AB04341079 for ; Tue, 13 Jan 2026 09:36:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768297020; cv=none; b=osbLESTtO/LPSm6NP/ccFdUck90BqVy2Xs/i7wNOOAKq1cs7miVOOUUY33KP7TFdPLhGxsrAne29M64d6fyvetpLhySYlTwtBoPcUUghTh3kDUBPAL8fGJUEctrGLq65bWzrV/+japZfB6C+qOwcXBZLhYaFtdRyCb++4bf5W6c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768297020; c=relaxed/simple; bh=i7jmKtKg7PeuT25Uc1BWE7cT/g0kspLdiSl6D9EotN8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=DLqSh5cy4ySWUtSU4/nJ+wgXpl9Z5RrbK1E7sLvulizdo1bWTdZTSxZ8s97JzksJDsqgVkdKgEfXKJvSOK604cn/ZxkNuag+DSlsjeB2s9dEqik27e7vrcdgePeH+G9wSrjUvr1Xj+9Y7a61aoFzcnQNkus07CF0FKClq4u1oCM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=icwgeptV; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=Qe4f/O7u; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="icwgeptV"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="Qe4f/O7u" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1768297016; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=pg4CF8mbdvXgdlxK3eag1qF9zBIQiZ4lLsv36mMbgWM=; b=icwgeptV+Jg0ZzSqHY3VkLZlNFRZqgXzgRmc9j2ZzTX9xjzkXwBANn0lBMj3nuld25WPCE t6lVSmGzdVYxS2mpYlz0ff2qsd75yDnWE2XQghEmOighE5S6D6cVVReAbMmWjnWNRQqtpf zI610qxeuHFlVm78k+t3+FA/rIQzXo8= Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-124-6QiA65MSOZCAftLnrMs_mw-1; Tue, 13 Jan 2026 04:36:54 -0500 X-MC-Unique: 6QiA65MSOZCAftLnrMs_mw-1 X-Mimecast-MFC-AGG-ID: 6QiA65MSOZCAftLnrMs_mw_1768297014 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-430ffc4dc83so6082171f8f.3 for ; Tue, 13 Jan 2026 01:36:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1768297011; x=1768901811; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=pg4CF8mbdvXgdlxK3eag1qF9zBIQiZ4lLsv36mMbgWM=; b=Qe4f/O7uRm8C2wshHKoVgSo0Kl26YcWaIctRvc5+rRbcMp2yIlc8OFcugjYLKVOeq9 Tzj3Q5U08ZrP2R0Xxm3iRN7AqvjusR8A1Dk/XusPD9tQLfw+cAORRGSyFrMKd/oMwIhI cadGQq+aELEVKZ+nopOlKUSbdvd/sEKEn72y9F729NaZWohibBmgfzB1pT7ZSuil5idq dqm5ajjqHPdj7utUjFTJPk8zqS3nic+LjyBpUOSMKlCcE5BvfO6KwBQ+JX5b/Xbs7452 JE6MAsYjCiWwIzCVr23zrG17w190MruR0v7YSznoXTrrLz5a0XXVwrslrz56d12hcnqr iE7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768297011; x=1768901811; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=pg4CF8mbdvXgdlxK3eag1qF9zBIQiZ4lLsv36mMbgWM=; b=O7VzyMQHNe4MQ0NAD3oR17MbaYhAeBVGuba/kQ9Srxf7xuCIthLrFVUbD5WcyzZvQP XnsXa/2dD28+Mm/oE5Ih7mopemCekuv2E/Jn6AdvtDIOSyizbT6EP/diuAKEpGXDpRs+ +c18k7pKC0s6XeW8oR6tWgRN7zBMcm+Ii9skpVb6qSXhF9kU/fcAbWLokG/c8D5BK3gX hd0yWjA0hF4w80TY9SQDTAXZSmj8ueoAukFpljZVwG9ewkiLLsTjqJqvKxS15LAXK24F WZlsjmIue5InrxHvARX8N8d3YmBgLNo2YivxTAbpOIZ0axDz398huca39cWNACFqcTrg +Gzw== X-Forwarded-Encrypted: i=1; AJvYcCXmtVMWtdZIMVS3q7k0IwH5rqpDxY/ltjCNHxsn+lqnwbzXaHpaN/xTUwq8+MeuMIyBvPF9TSAH6fGnJkk=@vger.kernel.org X-Gm-Message-State: AOJu0YwaE0XSf8OY/ETz6L2FpNbRmgQvW7pH4luOIOxDI4HempQinkBB JPuaSOu4ONjEdVxwtdHQz8touf88F0w0Y4s49TzieX2wPacbPkRueqHzZLmgq4t3TYJ2sKEzUFs eF40qREJmvSxTYdjt+VP4wzFB0u5gfb8rzDPAbVyJIzwLahY8nzSX5hxjCrqln8B1aw== X-Gm-Gg: AY/fxX5WEAsdec6FmHrKd61fks/8sZxKVKyfXGlH7C/De7SCEkWSQHmM1a8WmWN+tJ8 DKJHNzYjdVghAWr91ndo0wTdM5PIozxlJUcMRgbhl43MwfAm5lDILjLu8zNsmBL5JoPYWhdzn6b Hfygi4tG/AfEcGXe2YP1agHjpOVBUul4wMfS0g6ZbTTah60W8e4Q8GPOQKZM1IQxQd+bb8D5C6s 9FBCCUK2Uh+2oqnpIkozxvsumi1mET6nCktmQi+7EF1Edrtgqlmd9Ibx466BBHohVN1SRarwuAk rkRxC3NWV1siZt4Birv1Mw7mCDKJl7TyD+9bprZ2zIeefODTYlRRXttoc0qqpzYdVRVjlh3wjNl IM3l3E7vg5UX7cS4ncASvVnMsOmMPkUHgIL/Zti+1QmvXtUGgn7/VBPb3fKxzQQ== X-Received: by 2002:a05:600c:1394:b0:47d:3ffa:5f03 with SMTP id 5b1f17b1804b1-47d84b3467emr250088765e9.21.1768297011486; Tue, 13 Jan 2026 01:36:51 -0800 (PST) X-Google-Smtp-Source: AGHT+IHBInHZFJ8RidwkWLMCKS42wGE9AndYw8hKlz7EsNrZzGfvzlSbcNPT7twl1koVSE4j25wDOQ== X-Received: by 2002:a05:600c:1394:b0:47d:3ffa:5f03 with SMTP id 5b1f17b1804b1-47d84b3467emr250088215e9.21.1768297010851; Tue, 13 Jan 2026 01:36:50 -0800 (PST) Received: from sgarzare-redhat (host-87-12-25-233.business.telecomitalia.it. [87.12.25.233]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-432bd5fe83bsm43257713f8f.38.2026.01.13.01.36.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Jan 2026 01:36:50 -0800 (PST) Date: Tue, 13 Jan 2026 10:36:42 +0100 From: Stefano Garzarella To: Michal Luczaj Cc: "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , Eugenio =?utf-8?B?UMOpcmV6?= , Stefan Hajnoczi , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Arseniy Krasnov , kvm@vger.kernel.org, virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 2/2] vsock/test: Add test for a linear and non-linear skb getting coalesced Message-ID: References: <20260108-vsock-recv-coalescence-v1-0-26f97bb9a99b@rbox.co> <20260108-vsock-recv-coalescence-v1-2-26f97bb9a99b@rbox.co> <76ca0c9f-dcda-4a53-ac1f-c5c28d1ecf44@rbox.co> <080d7ae8-e184-4af8-bd72-765bb30b63a5@rbox.co> <0b15644b-9394-4734-9c0e-0a6d1355604a@rbox.co> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <0b15644b-9394-4734-9c0e-0a6d1355604a@rbox.co> On Mon, Jan 12, 2026 at 10:20:50PM +0100, Michal Luczaj wrote: >On 1/12/26 17:48, Stefano Garzarella wrote: >>>>>>> diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c >>>>>>> index bbe3723babdc..21c8616100f1 100644 >>>>>>> --- a/tools/testing/vsock/vsock_test.c >>>>>>> +++ b/tools/testing/vsock/vsock_test.c >>>>>>> @@ -2403,6 +2403,11 @@ static struct test_case test_cases[] = { >>>>>>> .run_client = test_stream_accepted_setsockopt_client, >>>>>>> .run_server = test_stream_accepted_setsockopt_server, >>>>>>> }, >>>>>>> + { >>>>>>> + .name = "SOCK_STREAM MSG_ZEROCOPY coalescence corruption", >>>>>> >>>>>> This is essentially a regression test for virtio transport, so I'd add >>>>>> virtio in the test name. >>>>> >>>>> Isn't virtio transport unaffected? It's about loopback transport (that >>>>> shares common code with virtio transport). >>>> >>>> Why virtio transport is not affected? >>> >>> With the usual caveat that I may be completely missing something, aren't >>> all virtio-transport's rx skbs linear? See virtio_vsock_alloc_linear_skb() >>> in virtio_vsock_rx_fill(). >>> >> >> True, but what about drivers/vhost/vsock.c ? >> >> IIUC in vhost_vsock_handle_tx_kick() we call vhost_vsock_alloc_skb(), >> that calls virtio_vsock_alloc_skb() and pass that skb to >> virtio_transport_recv_pkt(). So, it's also affected right? > >virtio_vsock_alloc_skb() returns a non-linear skb only if size > >SKB_WITH_OVERHEAD(PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)). And that is way >more than GOOD_COPY_LEN, so we're good. > >At least until someone increases GOOD_COPY_LEN and/or reduces the size >condition for non-linear allocation. So, yeah, a bit brittle. I see, thanks for clarify. So please add all of this conclusions in the patch 1 description to make it clear that only loopback is affected, so no guest/host attack is possible. (not really severe CVE) > >> BTW in general we consider loopback as one of virtio devices since it >> really shares with them most of the code. > >Fair enough, I'll add "virtio" to the test name. Thanks. > >> That said, now I'm thinking more about Fixes tag. >> Before commit 6693731487a8 ("vsock/virtio: Allocate nonlinear SKBs for >> handling large transmit buffers") was that a real issue? > >I don't really think that commit changes anything for the zerocopy case. It >only makes some big (>GOOD_COPY_LEN) non-ZC skbs turn non-linear. > I see. Stefano