linux-kernelorg-stable

Go to file

Will Deacon 7fb1291257 vsock/virtio: Fix message iterator handling on transmit path Commit `6693731487` ("vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers") converted the virtio vsock transmit path to utilise nonlinear SKBs when handling large buffers. As part of this change, virtio_transport_fill_skb() was updated to call skb_copy_datagram_from_iter() instead of memcpy_from_msg() as the latter expects a single destination buffer and cannot handle nonlinear SKBs correctly. Unfortunately, during this conversion, I overlooked the error case when the copying function returns -EFAULT due to a fault on the input buffer in userspace. In this case, memcpy_from_msg() reverts the iterator to its initial state thanks to copy_from_iter_full() whereas skb_copy_datagram_from_iter() leaves the iterator partially advanced. This results in a WARN_ONCE() from the vsock code, which expects the iterator to stay in sync with the number of bytes transmitted so that virtio_transport_send_pkt_info() can return -EFAULT when it is called again: ------------[ cut here ]------------ 'send_pkt()' returns 0, but 65536 expected WARNING: CPU: 0 PID: 5503 at net/vmw_vsock/virtio_transport_common.c:428 virtio_transport_send_pkt_info+0xd11/0xf00 net/vmw_vsock/virtio_transport_common.c:426 Modules linked in: CPU: 0 UID: 0 PID: 5503 Comm: syz.0.17 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call virtio_transport_fill_skb_full() to restore the previous iterator behaviour. Cc: Jason Wang <jasowang@redhat.com> Cc: Stefano Garzarella <sgarzare@redhat.com> Fixes: `6693731487` ("vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers") Reported-by: syzbot+b4d960daf7a3c7c2b7b1@syzkaller.appspotmail.com Signed-off-by: Will Deacon <will@kernel.org> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Link: https://patch.msgid.link/20250818180355.29275-3-will@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2025-08-21 17:49:19 -07:00
Documentation	Including fixes from Bluetooth.	2025-08-21 13:51:15 -04:00
LICENSES	…
arch	LoongArch: KVM: Add address alignment check in pch_pic register access	2025-08-20 22:51:15 +08:00
block	…
certs	…
crypto	…
drivers	Including fixes from Bluetooth.	2025-08-21 13:51:15 -04:00
fs	Three ksmbd smb3 server fixes	2025-08-21 04:48:41 -07:00
include	net: Introduce skb_copy_datagram_from_iter_full()	2025-08-21 17:47:57 -07:00
init	…
io_uring	…
ipc	…
kernel	Probes fixes for v6.17-rc2:	2025-08-20 16:29:30 -07:00
lib	Crypto library fixes for v6.17-rc3	2025-08-21 04:54:01 -07:00
mm	…
net	vsock/virtio: Fix message iterator handling on transmit path	2025-08-21 17:49:19 -07:00
rust	…
samples	…
scripts	…
security	…
sound	…
tools	Including fixes from Bluetooth.	2025-08-21 13:51:15 -04:00
usr	…
virt	…
.clang-format	…
.clippy.toml	…
.cocciconfig	…
.editorconfig	…
.get_maintainer.ignore	…
.gitattributes	…
.gitignore	…
.mailmap	…
.pylintrc	…
.rustfmt.toml	…
COPYING	…
CREDITS	…
Kbuild	…
Kconfig	…
MAINTAINERS	…
Makefile	Linux 6.17-rc2	2025-08-17 15:22:10 -07:00
README	…

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.