Re: [PATCH net v3] vhost/vsock: size receive SKBs from declared payload

[Paolo Abeni <pabeni@redhat.com>]

On 11/4/26 12:55, Michael S. Tsirkin wrote:
> On Mon, Oct 05, 2026 at 08:51:01AM +0900, Daehyeon Ko wrote:
>> vhost_vsock_alloc_skb() sizes the skb from iov_length(), the total guest
>> descriptor length.  virtio_transport_inc_rx_pkt() instead adds hdr->len to
>> rx_bytes and buf_used, and budgets each queued skb as SKB_TRUESIZE(0).  The
>> guest controls the descriptor length and hdr->len independently.
>>
>> A guest can therefore provide a 64 KiB descriptor while declaring a zero
>> payload.  The descriptor-sized skb remains queued, rx_bytes and buf_used
>> remain unchanged, and only the fixed queue-entry budget limits retention.
>> This is not a lifetime leak: the skb is freed when dequeued or at socket
>> teardown.  Repeating this across connections can nevertheless exhaust host
>> memory.  On Linux v7.2, 455 such descriptors retained 30,255,680 bytes for
>> a 262,144-byte receive buffer; a full-payload control retained 265,984
>> bytes.
>>
>> Vhost previously read hdr->len and allocated pkt->buf from that value.  The
>> conversion from virtio_vsock_pkt to sk_buff instead allocated receive skbs
>> from the descriptor length, introducing the allocation-accounting mismatch.
>>
>> Copy the header into a stack object and validate hdr->len before allocating
>> the skb.  Size the allocation as sizeof(hdr) + payload_len so descriptor
>> capacity no longer determines queued memory.  Check payload_len against
>> len - sizeof(hdr) to avoid addition overflow on 32-bit hosts.
>>
>> Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
>> Cc: stable@vger.kernel.org
>> Assisted-by: LLM
>> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
> 
> 
> Weird that this wasn't applied in net yet.
> 
> Acked-by: Michael S. Tsirkin <mst@redhat.com>
> 
> let me know if you want me to apply this.
Someone change the patch status to 'Not applicable' likely assuming it
was vhost stuff. The patch fell out our queue, but I just applied it.
I'm not sure if the bot will catch it up, given that the patch is so old.

/P