On Thu, Jan 08, 2026 at 10:54:55AM +0100, Michal Luczaj wrote:
Loopback transport can mangle data in rx queue when a linear skb is
followed by a small MSG_ZEROCOPY packet.
Can we describe a bit more what the test is doing?
Signed-off-by: Michal Luczaj <[email protected]>
---
tools/testing/vsock/vsock_test.c | 5 +++
tools/testing/vsock/vsock_test_zerocopy.c | 67 +++++++++++++++++++++++++++++++
tools/testing/vsock/vsock_test_zerocopy.h | 3 ++
3 files changed, 75 insertions(+)
diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c
index bbe3723babdc..21c8616100f1 100644
--- a/tools/testing/vsock/vsock_test.c
+++ b/tools/testing/vsock/vsock_test.c
@@ -2403,6 +2403,11 @@ static struct test_case test_cases[] = {
.run_client = test_stream_accepted_setsockopt_client,
.run_server = test_stream_accepted_setsockopt_server,
},
+ {
+ .name = "SOCK_STREAM MSG_ZEROCOPY coalescence corruption",
This is essentially a regression test for virtio transport, so I'd add
virtio in the test name.
+ .run_client = test_stream_msgzcopy_mangle_client,
+ .run_server = test_stream_msgzcopy_mangle_server,
+ },
{},
};
diff --git a/tools/testing/vsock/vsock_test_zerocopy.c
b/tools/testing/vsock/vsock_test_zerocopy.c
index 9d9a6cb9614a..6735a9d7525d 100644
--- a/tools/testing/vsock/vsock_test_zerocopy.c
+++ b/tools/testing/vsock/vsock_test_zerocopy.c
@@ -9,11 +9,13 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <sys/ioctl.h>
#include <sys/mman.h>
#include <unistd.h>
#include <poll.h>
#include <linux/errqueue.h>
#include <linux/kernel.h>
+#include <linux/sockios.h>
#include <errno.h>
#include "control.h"
@@ -356,3 +358,68 @@ void test_stream_msgzcopy_empty_errq_server(const struct
test_opts *opts)
control_expectln("DONE");
close(fd);
}
+
+#define GOOD_COPY_LEN 128 /* net/vmw_vsock/virtio_transport_common.c */
I think we don't need this, I mean we can eventually just send a single
byte, no?
+
+void test_stream_msgzcopy_mangle_client(const struct test_opts *opts)
+{
+ char sbuf1[PAGE_SIZE + 1], sbuf2[GOOD_COPY_LEN];
+ struct pollfd fds;
+ int fd;
+
+ fd = vsock_stream_connect(opts->peer_cid, opts->peer_port);
+ if (fd < 0) {
+ perror("connect");
+ exit(EXIT_FAILURE);
+ }
+
+ enable_so_zerocopy_check(fd);
+
+ memset(sbuf1, '1', sizeof(sbuf1));
+ memset(sbuf2, '2', sizeof(sbuf2));
+
+ send_buf(fd, sbuf1, sizeof(sbuf1), 0, sizeof(sbuf1));
+ send_buf(fd, sbuf2, sizeof(sbuf2), MSG_ZEROCOPY, sizeof(sbuf2));
+
+ fds.fd = fd;
+ fds.events = 0;
+
+ if (poll(&fds, 1, -1) != 1 || !(fds.revents & POLLERR)) {
+ perror("poll");
+ exit(EXIT_FAILURE);
+ }
Should we also call vsock_recv_completion() or we don't care about the
result?
If we need it, maybe we can factor our the poll +
vsock_recv_completion().
+
+ close(fd);
+}
+
+static void recv_verify(int fd, char *buf, unsigned int len, char pattern)
+{
+ recv_buf(fd, buf, len, 0, len);
+
+ while (len--) {
+ if (*buf++ != pattern) {
+ fprintf(stderr, "Incorrect data received\n");
+ exit(EXIT_FAILURE);
+ }
+ }
+}
+
+void test_stream_msgzcopy_mangle_server(const struct test_opts *opts)
+{
+ char rbuf[PAGE_SIZE + 1];
+ int fd;
+
+ fd = vsock_stream_accept(VMADDR_CID_ANY, opts->peer_port, NULL);
+ if (fd < 0) {
+ perror("accept");
+ exit(EXIT_FAILURE);
+ }
+
+ /* Wait, don't race the (buggy) skbs coalescence. */
+ vsock_ioctl_int(fd, SIOCINQ, PAGE_SIZE + 1 + GOOD_COPY_LEN);
This is cool, another option is to add a barrier here (and after the
poll), but yeah, this should be even better.
Thanks,
Stefano
+
+ recv_verify(fd, rbuf, PAGE_SIZE + 1, '1');
+ recv_verify(fd, rbuf, GOOD_COPY_LEN, '2');
+
+ close(fd);
+}
diff --git a/tools/testing/vsock/vsock_test_zerocopy.h
b/tools/testing/vsock/vsock_test_zerocopy.h
index 3ef2579e024d..d46c91a69f16 100644
--- a/tools/testing/vsock/vsock_test_zerocopy.h
+++ b/tools/testing/vsock/vsock_test_zerocopy.h
@@ -12,4 +12,7 @@ void test_seqpacket_msgzcopy_server(const struct test_opts
*opts);
void test_stream_msgzcopy_empty_errq_client(const struct test_opts *opts);
void test_stream_msgzcopy_empty_errq_server(const struct test_opts
*opts);
+void test_stream_msgzcopy_mangle_client(const struct test_opts *opts);
+void test_stream_msgzcopy_mangle_server(const struct test_opts *opts);
+
#endif /* VSOCK_TEST_ZEROCOPY_H */
--
2.52.0
