linux-toradex.git/net/vmw_vsock, branch master

vsock: support SO_INQ on stream sockets

2026-10-21T09:58:21+00:00

SO_INQ makes recvmsg() return the bytes left in the receive queue in an
SCM_INQ cmsg, saving a SIOCINQ call per receive. AF_UNIX stream sockets
support it, AF_VSOCK fails with ENOPROTOOPT.

Add it for SOCK_STREAM, reusing the hint already computed for io_uring.
As with TCP_INQ, 1 is reported once the stream is finished so the caller
reads again and sees EOF, and accepted sockets inherit the setting from
the listener. No cmsg is sent when the transport cannot report the queue
length.

SOCK_SEQPACKET is refused, as on AF_UNIX: its transport callback counts
messages, not bytes.

Signed-off-by: David Carlier 
Reviewed-by: Stefano Garzarella 
Link: https://patch.msgid.link/20261016132716.272018-3-devnexen@gmail.com
Signed-off-by: Paolo Abeni

vsock: move SOL_SOCKET options to vsock_sol_socket_setsockopt()

2026-10-21T09:58:21+00:00

SO_ZEROCOPY is handled inline in vsock_connectible_setsockopt(). Move it
to a helper with a switch on optname, so other SOL_SOCKET options can be
added as new cases. The value parsing goes to its own helper too, so each
option can do its own checks before it.

No functional change.

Signed-off-by: David Carlier 
Reviewed-by: Stefano Garzarella 
Link: https://patch.msgid.link/20261016132716.272018-2-devnexen@gmail.com
Signed-off-by: Paolo Abeni

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-10-15T16:24:47+00:00

Cross-merge networking fixes after downstream PR (net-7.3-rc8).

No conflicts. Adjacent changes:

drivers/net/ethernet/microchip/lan865x/lan865x.c
  2a3f6d2a9ac3 ("microchip: lan865x: move setting of netops to fix crash")
  15358c2c3dca ("net: ethernet: oa_tc6: return ERR_PTR from oa_tc6_init()")

Signed-off-by: Jakub Kicinski

vsock: treat TCP_CLOSING as once-established

2026-10-12T14:55:20+00:00

Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can
race with the connect loop. Immediately break and return 0 on
ESTABLISHED/CLOSING. The return value of connect() should reflect what
happened up to the point the connection was established or failed. Events
that occur afterwards must not affect it. E.g. even if OP_RW has already
set sk_err, connect() should still return 0, not ENOBUFS because of it.
Adapt the inaccurate comment above signal_pending().

Resetting a socket that is still present in connected_table can lead to
memory corruption. The reporter noted lost transports for in-flight skbs,
and I have reproduced crashes caused by re-insertion into connected_table.

  list_add double add: new=, prev=, next=.
  kernel BUG at lib/list_debug.c:35!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  Workqueue: vsock-loopback vsock_loopback_work
  RIP: 0010:__list_add_valid_or_report+0x11f/0x130
  Call Trace:
   vsock_insert_connected.cold+0xe/0x13
   virtio_transport_recv_pkt+0x10e9/0x1460
   vsock_loopback_work+0x305/0x480
   process_one_work+0xe4c/0x1560
   worker_thread+0x4f1/0xd60
   kthread+0x36e/0x470
   ret_from_fork+0x47b/0x6b0
   ret_from_fork_asm+0x1a/0x30

This fix is supplementary to commit 002541ef650b ("vsock: Ignore
signal/timeout on connect() if already established"). Details under Link.

Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Reported-by: Hyunwoo Kim 
Link: https://lore.kernel.org/netdev/anzT1fREOSyHT99k@v4bel/
Signed-off-by: Michal Luczaj 
Reviewed-by: Stefano Garzarella 
Link: https://patch.msgid.link/20261005-vsock-connect-reset-closing-v4-1-15d41cfda3ed@rbox.co
Signed-off-by: Paolo Abeni

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-10-09T05:21:56+00:00

Cross-merge networking fixes after downstream PR (net-7.3-rc7).

Conflicts:

include/net/strparser.h
  0984ebc631792 ("strparser: make sure __strp_recv isn't running before tearing down the parser")
  02fd0a2111374 ("net: strparser: removed the aborted bit and aborts counter")
https://lore.kernel.org/asYfmLsfy-SCxXjr@sirena.co.uk

Adjacent changes:

Documentation/networking/strparser.rst
  5f193cdabf25 ("docs: networking: strparser: remove general mode")
  0984ebc63179 ("strparser: make sure __strp_recv isn't running before tearing down the parser")

Signed-off-by: Jakub Kicinski

vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

2026-10-08T18:46:13+00:00

During the closure of a datagram socket, the vmci_transport_recv_dgram_cb()
function may be called, which will add the packets
to the socket's backlog; then, after the receive queue is cleared,
the __release_sock() function will move the packet back from the socket's
backlog to the receive queue, which will lead to a memory leak.

sock_close
  __sock_release
    __vsock_release
      // take ownership by user-space
      lock_sock_nested
      sock_set_flag(sk, SOCK_DEAD)
      vmci_transport_release
                                      vmci_dispatch_dgs
                                        vmci_datagram_invoke_guest_handler
                                          vmci_transport_recv_dgram_cb
                                            sk_receive_skb
                                              if (!sock_owned_by_user(sk))
                                                  [...]
                                         (!)  else if sk_add_backlog()
                                                  [...]
  (!) skb_queue_purge(&sk->sk_receive_queue)

      release_sock
        __release_sock
          // move all packets from the backlog
          // to the receive queue
   (!)    sk_backlog_rcv
            vsock_queue_rcv_skb
            [...]
              __sock_queue_rcv_skb
                if (!sock_flag(sk, SOCK_DEAD))
                  // Since the socket is "dead", the function will not
                  // be called
                  sk->sk_data_ready(sk)
        sock_release_ownership(sk);
        sock_put

Add a receive queue cleanup in the socket destructor to fix this.

syzkaller report:

unreferenced object 0xffff8880117bfb80 (size 240):
  comm "irq/56-vmw_vmci", pid 205, jiffies 4295064448 (age 73.992s)
  hex dump (first 32 bytes):
    78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff  x.&.....x.&.....
    00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff  ..........&.....
  backtrace:
    [] __alloc_skb+0x287/0x330 net/core/skbuff.c:505
    [] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]
    [] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]
    [] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]
    [] vmci_interrupt+0x55/0x290 [vmw_vmci]
    [] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205
    [] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314
    [] kthread+0x2e6/0x3a0 kernel/kthread.c:376
    [] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller.

Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Reviewed-by: Stefano Garzarella 
Signed-off-by: Ilia Gavrilov 
Link: https://patch.msgid.link/20261008144046.90853-1-Ilia.Gavrilov@infotecs.ru
Signed-off-by: Jakub Kicinski

vsock/virtio: account only unread bytes in read_skb()

2026-10-06T23:11:49+00:00

After a partial stream receive, rx_bytes tracks the unread suffix while
buf_used and peer credit still cover the whole packet.
virtio_transport_read_skb() dequeues that packet but passes pkt_len for
both counters, underflowing rx_bytes.

On a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte read
from a 100-byte packet made SIOCINQ report -40, an empty recv return
ELOOP, and poll report the empty socket readable.  After verdict detach,
receiving 40 bytes wrapped the counter to zero and hid those queued bytes
until one more byte arrived.  The fixed run kept the counter balanced
and exposed all queued data immediately.

This was found during an LLM-assisted manual source audit of VSOCK
receive accounting while re-evaluating virtio_transport_read_skb() after
CVE-2024-50169.

Subtract only skb->len minus the VSOCK offset from rx_bytes.  Retain the
full packet length for buf_used and peer credit.

Fixes: 45ca7e9f0730 ("vsock/virtio: fix `rx_bytes` accounting for stream sockets")
Cc: stable@vger.kernel.org
Reviewed-by: Luigi Leonardi 
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20261001151310.4101006-1-4ncienth@gmail.com
Signed-off-by: Jakub Kicinski

vsock: report pending receive data to io_uring

2026-09-29T00:27:09+00:00

AF_VSOCK stream receives never fill msghdr.msg_inq, so io_uring cannot set
IORING_CQE_F_SOCK_NONEMPTY and retries a multishot receive even after the
queue has been drained.

Fill the hint at the common receive exit using the transport callback that
SIOCINQ already uses, and report 1 once the connection is finished so the
caller performs the receive which observes EOF, as TCP does after a FIN.

A vsock loopback ping-pong with io_uring multishot receive drops entries
into __vsock_connectible_recvmsg from 1.97 to 1.00 per delivered message,
and receiver CPU time by about 3% (25 runs of 50000 messages, p=0.006).

Signed-off-by: David Carlier 
Reviewed-by: Stefano Garzarella 
Link: https://patch.msgid.link/20260923184008.153541-2-devnexen@gmail.com
Signed-off-by: Jakub Kicinski

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-09-24T20:32:50+00:00

Cross-merge networking fixes after downstream PR (net-7.3-rc5).

Conflicts:

drivers/net/mdio/mdio-realtek-rtl9300.c
  89a8a1eef2d44 ("net: mdio: realtek-rtl9300: fix RTL931x C22 extended page selection")
  cc3cb8db1eef9 ("net: mdio: realtek-rtl9300: Add page tracking")
https://lore.kernel.org/arUZOqy73bE2pp0w@sirena.org.uk

net/8021q/vlan_dev.c
  cd5dd68267c4 ("vlan: ensure sufficient headroom in vlan_dev_hard_header()")
  ca6ff8dd70eb ("vlan: annotate data-races in vlan_dev_priv fields")

Adjacent changes:

net/ipv6/ip6_gre.c
  dd47bcf279f1 ("ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().")
  cce829e2aa1d ("ip6_gre: Protect ip6gre_net.tunnels[][] with mutex.")

drivers/net/ethernet/meta/fbnic/fbnic_txrx.c
  b5d9e9d4d0c1 ("eth: fbnic: use the Rx queue napi pointer to find the napi vector")
  c0aca269ec07 ("eth: fbnic: Make Rx completion coalescing configurable")

drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
  d68acbf93531 ("net: stmmac: selftests: Support running selftests on DSA conduits")
  85ca3292d7a3 ("net: stmmac: Remove ARP offload code")

drivers/net/ethernet/wangxun/libwx/wx_hw.c
  3173cba11701 ("net: libwx: fix races in Tx timestamp handling")
  7042c8c193e5 ("net: libwx: rename wx_pf_flags to wx_flags")

Signed-off-by: Jakub Kicinski

vsock: remove dev_hold() and dev_put() in __vsock_deliver_tap_skb()

2026-09-22T13:16:24+00:00

__vsock_deliver_tap_skb() is called from vsock_deliver_tap()
under rcu_read_lock().

dev_queue_xmit() does not require the caller to hold a device reference
count, and the device lifetime is already protected by RCU.

Remove the redundant dev_hold(dev) and dev_put(dev) calls.

Signed-off-by: Eric Dumazet 
Cc: Stefano Garzarella 
Reviewed-by: Bobby Eshleman 
Reviewed-by: Stefano Garzarella 
Link: https://patch.msgid.link/20260921094218.483234-1-edumazet@google.com
Signed-off-by: Paolo Abeni