On Fri, May 15, 2026 at 04:22:12PM +0200, Luigi Leonardi wrote: > From: Eric Dumazet <[email protected]> > > Upstream commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5 > > virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. > > virtio_transport_recv_enqueue() skips coalescing for packets > with VIRTIO_VSOCK_SEQ_EOM. > > If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, > a very large number of packets can be queued > because vvs->rx_bytes stays at 0. > > Fix this by estimating the skb metadata size: > > (Number of skbs in the queue) * SKB_TRUESIZE(0) > > Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit") > Signed-off-by: Eric Dumazet <[email protected]> > Cc: Arseniy Krasnov <[email protected]> > Cc: Stefan Hajnoczi <[email protected]> > Cc: Stefano Garzarella <[email protected]> > Cc: Michael S. Tsirkin <[email protected]> > Cc: Jason Wang <[email protected]> > Cc: Xuan Zhuo <[email protected]> > Cc: Eugenio Pérez <[email protected]> > Cc: [email protected] > Link: https://patch.msgid.link/[email protected] > Signed-off-by: Jakub Kicinski <[email protected]> > [LL: Fixed conflict since this tree does not use buf_used added by commit > 45ca7e9f0730 ("vsock/virtio: fix `rx_bytes` accounting for stream sockets")] > Signed-off-by: Luigi Leonardi <[email protected]> > --- > net/vmw_vsock/virtio_transport_common.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/net/vmw_vsock/virtio_transport_common.c > b/net/vmw_vsock/virtio_transport_common.c > index 4c374c36c29d..86e3051d000e 100644 > --- a/net/vmw_vsock/virtio_transport_common.c > +++ b/net/vmw_vsock/virtio_transport_common.c > @@ -283,7 +283,9 @@ static int virtio_transport_send_pkt_info(struct > vsock_sock *vsk, > static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs, > u32 len) > { > - if (vvs->rx_bytes + len > vvs->buf_alloc) > + u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * > SKB_TRUESIZE(0); > + > + if (skb_overhead + vvs->rx_bytes + len > vvs->buf_alloc) > return false; > > vvs->rx_bytes += len; > > --- > base-commit: 3b9f64db049687c0d38b4b3ef2f297f0642179af > change-id: 20260515-dumazet-07c0c855a9e2 > > Best regards, > -- > Luigi Leonardi <[email protected]>
I am not sure we should queue this for stable yet. It causes regressions that we are now trying to fix. -- MST
