Re: [PATCH net 1/2] vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy
From: Stefano Garzarella <sgarzare@redhat.com>
Date: 2026-04-02 13:08:30
Also in:
kvm, lkml, virtualization
On Thu, Apr 02, 2026 at 10:18:01AM +0200, Luigi Leonardi wrote:
`virtio_transport_stream_do_peek()` does not account for the skb offset when computing the number of bytes to copy. This means that, after a partial recv() that advances the offset, a peek requesting more bytes than are available in the sk_buff causes `skb_copy_datagram_iter()` to go past the valid payload, resulting in a -EFAULT.
nit: WARNING: Prefer a maximum 75 chars per line (possible unwrapped commit description?) #14: `skb_copy_datagram_iter()` to go past the valid payload, resulting in a -EFAULT.
quoted hunk ↗ jump to hunk
The dequeue path already handles this correctly. Apply the same logic to the peek path. Fixes: 0df7cd3c13e4 ("vsock/virtio/vhost: read data from non-linear skb") Signed-off-by: Luigi Leonardi <redacted> --- net/vmw_vsock/virtio_transport_common.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index 8a9fb23c6e853dfea0a24d3787f7d6eb351dd6c6..4b65bfe5d875111f115e0fc4c6727adb66f34830 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c@@ -547,9 +547,8 @@ virtio_transport_stream_do_peek(struct vsock_sock *vsk,skb_queue_walk(&vvs->rx_queue, skb) { size_t bytes; - bytes = len - total; - if (bytes > skb->len) - bytes = skb->len; + bytes = min_t(size_t, len - total, + skb->len - VIRTIO_VSOCK_SKB_CB(skb)->offset);
I think we should add some helper like virtio_transport_skb_remain() or virtio_transport_skb_bytes() and use it here but also in places where we check offset < len or offset == len. But maybe better to do that in another patch/series for net-next. This fix LGTM: Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>