hv_sock: Return -EIO for malformed/short packets

Commit f63152958994 fixes a regression, however it fails to report an
error for malformed/short packets -- normally we should never see such
packets, but let's report an error for them just in case.

Fixes: f63152958994 ("hv_sock: Report EOF instead of -EIO for FIN")
Cc: stable@vger.kernel.org
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20260423064811.1371749-1-decui@microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index 76e78c83fdbcaaa3873b16b521bef354bc3cbfa3..f862988c1e865ebd0efaa62e9765325e8ac76a23 100644 (file)
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -704,17 +704,26 @@ static s64 hvs_stream_has_data(struct vsock_sock *vsk)
                if (hvs->recv_desc) {
                        /* Here hvs->recv_data_len is 0, so hvs->recv_desc must
                         * be NULL unless it points to the 0-byte-payload FIN
-                        * packet: see hvs_update_recv_data().
+                        * packet or a malformed/short packet: see
+                        * hvs_update_recv_data().
                         *
-                        * Here all the payload has been dequeued, but
-                        * hvs_channel_readable_payload() still returns 1,
-                        * because the VMBus ringbuffer's read_index is not
-                        * updated for the FIN packet: hvs_stream_dequeue() ->
-                        * hv_pkt_iter_next() updates the cached priv_read_index
-                        * but has no opportunity to update the read_index in
-                        * hv_pkt_iter_close() as hvs_stream_has_data() returns
-                        * 0 for the FIN packet, so it won't get dequeued.
+                        * If hvs->recv_desc points to the FIN packet, here all
+                        * the payload has been dequeued and the peer_shutdown
+                        * flag is set, but hvs_channel_readable_payload() still
+                        * returns 1, because the VMBus ringbuffer's read_index
+                        * is not updated for the FIN packet:
+                        * hvs_stream_dequeue() -> hv_pkt_iter_next() updates
+                        * the cached priv_read_index but has no opportunity to
+                        * update the read_index in hv_pkt_iter_close() as
+                        * hvs_stream_has_data() returns 0 for the FIN packet,
+                        * so it won't get dequeued.
+                        *
+                        * In case hvs->recv_desc points to a malformed/short
+                        * packet, return -EIO.
                         */
+                       if (!(vsk->peer_shutdown & SEND_SHUTDOWN))
+                               return -EIO;
+
                        return 0;
                }