Re: [PATCH 2/2] vsock/test: Add test for a linear and non-linear skb getting coalesced
From: Stefano Garzarella <sgarzare@redhat.com>
Date: 2026-01-09 16:32:37
Also in:
kvm, lkml, virtualization
On Thu, Jan 08, 2026 at 10:54:55AM +0100, Michal Luczaj wrote:
Loopback transport can mangle data in rx queue when a linear skb is followed by a small MSG_ZEROCOPY packet.
Can we describe a bit more what the test is doing?
quoted hunk ↗ jump to hunk
Signed-off-by: Michal Luczaj <redacted> --- tools/testing/vsock/vsock_test.c | 5 +++ tools/testing/vsock/vsock_test_zerocopy.c | 67 +++++++++++++++++++++++++++++++ tools/testing/vsock/vsock_test_zerocopy.h | 3 ++ 3 files changed, 75 insertions(+)diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c index bbe3723babdc..21c8616100f1 100644 --- a/tools/testing/vsock/vsock_test.c +++ b/tools/testing/vsock/vsock_test.c@@ -2403,6 +2403,11 @@ static struct test_case test_cases[] = {.run_client = test_stream_accepted_setsockopt_client, .run_server = test_stream_accepted_setsockopt_server, }, + { + .name = "SOCK_STREAM MSG_ZEROCOPY coalescence corruption",
This is essentially a regression test for virtio transport, so I'd add virtio in the test name.
quoted hunk ↗ jump to hunk
+ .run_client = test_stream_msgzcopy_mangle_client, + .run_server = test_stream_msgzcopy_mangle_server, + }, {}, };diff --git a/tools/testing/vsock/vsock_test_zerocopy.c b/tools/testing/vsock/vsock_test_zerocopy.c index 9d9a6cb9614a..6735a9d7525d 100644 --- a/tools/testing/vsock/vsock_test_zerocopy.c +++ b/tools/testing/vsock/vsock_test_zerocopy.c@@ -9,11 +9,13 @@#include <stdio.h> #include <stdlib.h> #include <string.h> +#include <sys/ioctl.h> #include <sys/mman.h> #include <unistd.h> #include <poll.h> #include <linux/errqueue.h> #include <linux/kernel.h> +#include <linux/sockios.h> #include <errno.h> #include "control.h"@@ -356,3 +358,68 @@ void test_stream_msgzcopy_empty_errq_server(const struct test_opts *opts)control_expectln("DONE"); close(fd); } + +#define GOOD_COPY_LEN 128 /* net/vmw_vsock/virtio_transport_common.c */
I think we don't need this, I mean we can eventually just send a single byte, no?
+
+void test_stream_msgzcopy_mangle_client(const struct test_opts *opts)
+{
+ char sbuf1[PAGE_SIZE + 1], sbuf2[GOOD_COPY_LEN];
+ struct pollfd fds;
+ int fd;
+
+ fd = vsock_stream_connect(opts->peer_cid, opts->peer_port);
+ if (fd < 0) {
+ perror("connect");
+ exit(EXIT_FAILURE);
+ }
+
+ enable_so_zerocopy_check(fd);
+
+ memset(sbuf1, '1', sizeof(sbuf1));
+ memset(sbuf2, '2', sizeof(sbuf2));
+
+ send_buf(fd, sbuf1, sizeof(sbuf1), 0, sizeof(sbuf1));
+ send_buf(fd, sbuf2, sizeof(sbuf2), MSG_ZEROCOPY, sizeof(sbuf2));
+
+ fds.fd = fd;
+ fds.events = 0;
+
+ if (poll(&fds, 1, -1) != 1 || !(fds.revents & POLLERR)) {
+ perror("poll");
+ exit(EXIT_FAILURE);
+ }Should we also call vsock_recv_completion() or we don't care about the result? If we need it, maybe we can factor our the poll + vsock_recv_completion().
+
+ close(fd);
+}
+
+static void recv_verify(int fd, char *buf, unsigned int len, char pattern)
+{
+ recv_buf(fd, buf, len, 0, len);
+
+ while (len--) {
+ if (*buf++ != pattern) {
+ fprintf(stderr, "Incorrect data received\n");
+ exit(EXIT_FAILURE);
+ }
+ }
+}
+
+void test_stream_msgzcopy_mangle_server(const struct test_opts *opts)
+{
+ char rbuf[PAGE_SIZE + 1];
+ int fd;
+
+ fd = vsock_stream_accept(VMADDR_CID_ANY, opts->peer_port, NULL);
+ if (fd < 0) {
+ perror("accept");
+ exit(EXIT_FAILURE);
+ }
+
+ /* Wait, don't race the (buggy) skbs coalescence. */
+ vsock_ioctl_int(fd, SIOCINQ, PAGE_SIZE + 1 + GOOD_COPY_LEN);This is cool, another option is to add a barrier here (and after the poll), but yeah, this should be even better. Thanks, Stefano
quoted hunk ↗ jump to hunk
+ + recv_verify(fd, rbuf, PAGE_SIZE + 1, '1'); + recv_verify(fd, rbuf, GOOD_COPY_LEN, '2'); + + close(fd); +}diff --git a/tools/testing/vsock/vsock_test_zerocopy.h b/tools/testing/vsock/vsock_test_zerocopy.h index 3ef2579e024d..d46c91a69f16 100644 --- a/tools/testing/vsock/vsock_test_zerocopy.h +++ b/tools/testing/vsock/vsock_test_zerocopy.h@@ -12,4 +12,7 @@ void test_seqpacket_msgzcopy_server(const struct test_opts *opts);void test_stream_msgzcopy_empty_errq_client(const struct test_opts *opts); void test_stream_msgzcopy_empty_errq_server(const struct test_opts *opts); +void test_stream_msgzcopy_mangle_client(const struct test_opts *opts); +void test_stream_msgzcopy_mangle_server(const struct test_opts *opts); + #endif /* VSOCK_TEST_ZEROCOPY_H */ -- 2.52.0