linux-kernel - Re: [syzbot] [kvm?] [net?] [virt?] WARNING in virtio_transport_send_pkt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aJ8heyq4-RtJAPyI@willie-the-truck>
Date: Fri, 15 Aug 2025 13:00:59 +0100
From: Will Deacon <will@...nel.org>
To: "Michael S. Tsirkin" <mst@...hat.com>
Cc: syzbot <syzbot+b4d960daf7a3c7c2b7b1@...kaller.appspotmail.com>,
	davem@...emloft.net, edumazet@...gle.com, eperezma@...hat.com,
	horms@...nel.org, jasowang@...hat.com, kuba@...nel.org,
	kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org, pabeni@...hat.com, sgarzare@...hat.com,
	stefanha@...hat.com, syzkaller-bugs@...glegroups.com,
	virtualization@...ts.linux.dev, xuanzhuo@...ux.alibaba.com
Subject: Re: [syzbot] [kvm?] [net?] [virt?] WARNING in
 virtio_transport_send_pkt_info

On Fri, Aug 15, 2025 at 06:44:47AM -0400, Michael S. Tsirkin wrote:
> On Fri, Aug 15, 2025 at 11:09:24AM +0100, Will Deacon wrote:
> > On Tue, Aug 12, 2025 at 06:15:46AM -0400, Michael S. Tsirkin wrote:
> > > On Tue, Aug 12, 2025 at 03:03:02AM -0700, syzbot wrote:
> > > > Hello,
> > > > 
> > > > syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> > > > WARNING in virtio_transport_send_pkt_info
> > > 
> > > OK so the issue triggers on
> > > commit 6693731487a8145a9b039bc983d77edc47693855
> > > Author: Will Deacon <will@...nel.org>
> > > Date:   Thu Jul 17 10:01:16 2025 +0100
> > > 
> > >     vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers
> > >     
> > > 
> > > but does not trigger on:
> > > 
> > > commit 8ca76151d2c8219edea82f1925a2a25907ff6a9d
> > > Author: Will Deacon <will@...nel.org>
> > > Date:   Thu Jul 17 10:01:15 2025 +0100
> > > 
> > >     vsock/virtio: Rename virtio_vsock_skb_rx_put()
> > >     
> > > 
> > > 
> > > Will, I suspect your patch merely uncovers a latent bug
> > > in zero copy handling elsewhere.

I'm still looking at this, but I'm not sure zero-copy is the right place
to focus on.

The bisected patch 6693731487a8 ("vsock/virtio: Allocate nonlinear SKBs
for handling large transmit buffers") only has two hunks. The first is
for the non-zcopy case and the latter is a no-op for zcopy, as
skb_len == VIRTIO_VSOCK_SKB_HEADROOM and so we end up with a linear SKB
regardless.

I'll keep digging...

Will