--- /dev/null
+From 49d8c5ffad07ca014cfae72a1b9b8c52b6ad9cb8 Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Mon, 22 Nov 2021 17:35:24 +0100
+Subject: vhost/vsock: fix incorrect used length reported to the guest
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+commit 49d8c5ffad07ca014cfae72a1b9b8c52b6ad9cb8 upstream.
+
+The "used length" reported by calling vhost_add_used() must be the
+number of bytes written by the device (using "in" buffers).
+
+In vhost_vsock_handle_tx_kick() the device only reads the guest
+buffers (they are all "out" buffers), without writing anything,
+so we must pass 0 as "used length" to comply virtio spec.
+
+Fixes: 433fc58e6bf2 ("VSOCK: Introduce vhost_vsock.ko")
+Cc: stable@vger.kernel.org
+Reported-by: Halil Pasic <pasic@linux.ibm.com>
+Suggested-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Link: https://lore.kernel.org/r/20211122163525.294024-2-sgarzare@redhat.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/vsock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -490,7 +490,7 @@ static void vhost_vsock_handle_tx_kick(s
+ virtio_transport_free_pkt(pkt);
+
+ len += sizeof(pkt->hdr);
+- vhost_add_used(vq, head, len);
++ vhost_add_used(vq, head, 0);
+ total_len += len;
+ added = true;
+ } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len)));