Subject: [PATCH 7.0 198/201] vsock/virtio: fix potential unbounded skb queue

From: Greg Kroah-Hartman <[email-masked]>
Date: Fri, 15 May 2026 17:50:16 +0200

7.0-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <[email-masked]>

commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5 upstream.

virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.

virtio_transport_recv_enqueue() skips coalescing for packets
with VIRTIO_VSOCK_SEQ_EOM.

If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM,
a very large number of packets can be queued
because vvs->rx_bytes stays at 0.

Fix this by estimating the skb metadata size:

	(Number of skbs in the queue) * SKB_TRUESIZE(0)

Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit")
Signed-off-by: Eric Dumazet <[email-masked]>
Cc: Arseniy Krasnov <[email-masked]>
Cc: Stefan Hajnoczi <[email-masked]>
Cc: Stefano Garzarella <[email-masked]>
Cc: "Michael S. Tsirkin" <[email-masked]>
Cc: Jason Wang <[email-masked]>
Cc: Xuan Zhuo <[email-masked]>
Cc: "Eugenio Pérez" <[email-masked]>
Cc: [email-masked]
Link: https://patch.msgid.link/[email-masked]
Signed-off-by: Jakub Kicinski <[email-masked]>
Cc: Luigi Leonardi <[email-masked]>
Signed-off-by: Greg Kroah-Hartman <[email-masked]>
---
 net/vmw_vsock/virtio_transport_common.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -429,7 +429,9 @@ static int virtio_transport_send_pkt_inf
 static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs,
 					u32 len)
 {
-	if (vvs->buf_used + len > vvs->buf_alloc)
+	u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0);
+
+	if (skb_overhead + vvs->buf_used + len > vvs->buf_alloc)
 		return false;
 
 	vvs->rx_bytes += len;