Re: [PATCH 1/5] vhost/vsock: Avoid allocating arbitrarily-sized SKBs

[Stefano Garzarella]

On Mon, Jun 30, 2025 at 01:51:07PM +0100, Will Deacon wrote:
> On Fri, Jun 27, 2025 at 12:36:46PM +0200, Stefano Garzarella wrote:
> > On Wed, Jun 25, 2025 at 02:15:39PM +0100, Will Deacon wrote:
> > > vhost_vsock_alloc_skb() returns NULL for packets advertising a length
> > > larger than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE in the packet header. However,
> > > this is only checked once the SKB has been allocated and, if the length
> > > in the packet header is zero, the SKB may not be freed immediately.
> > >
> > > Hoist the size check before the SKB allocation so that an iovec larger
> > > than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + the header size is rejected
> > > outright. The subsequent check on the length field in the header can
> > > then simply check that the allocated SKB is indeed large enough to hold
> > > the packet.
> >
> > LGTM, but should we consider this as stable material adding a Fixes tag?
>
> Yup, absolutely. I put it first so that it can be backported easily but,
> for some reason, I thought networking didn't CC stable. I have no idea
> _why_ I thought that, so I'll add it (and a Fixes: line) for v2!

yeah, this was the case till last year IIRC, but we always used Fixes 
tag, also if we didn't cc stable.

> That seems to be:
>
>  Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
>
> from what I can tell.

I think so!

Thanks,
Stefano