vsock/virtio: bind uarg before filling zerocopy skb

virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg
before entering the send loop, but virtio_transport_alloc_skb() still
fills the skb before it inherits that uarg. When fixed-buffer vectored
zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach
managed frags and return -EMSGSIZE. The rollback path call kfree_skb()
to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so
skb_release_data() falls through to ordinary frag unref.

Pass the uarg into virtio_transport_alloc_skb() and bind it immediately
before virtio_transport_fill_skb(). This keeps control or no-payload skbs
untouched while ensuring success and rollback share one lifetime rule.

Fixes: 581512a6dc93 ("vsock/virtio: MSG_ZEROCOPY flag support")
Signed-off-by: Lin Ma <malin89@huawei.com>
Signed-off-by: Rongzhen Cui <cuirongzhen@huawei.com>
Signed-off-by: Jingguo Tan <tanjingguo@huawei.com>
Acked-by: Arseniy Krasnov <avkrasnov@salutedevices.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20260527023301.1075581-1-malin89@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index b143290a311d1ffac6c181aa6ae45ac58703a23f..b10666937c4908d3bdc98d6c43b9a07c246e391e 100644 (file)
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -205,6 +205,7 @@ static u16 virtio_transport_get_type(struct sock *sk)
 static struct sk_buff *virtio_transport_alloc_skb(struct virtio_vsock_pkt_info *info,
                                                  size_t payload_len,
                                                  bool zcopy,
+                                                 struct ubuf_info *uarg,
                                                  u32 src_cid,
                                                  u32 src_port,
                                                  u32 dst_cid,
@@ -245,6 +246,12 @@ static struct sk_buff *virtio_transport_alloc_skb(struct virtio_vsock_pkt_info *
        if (info->msg && payload_len > 0) {
                int err;
 
+               /* Bind the zerocopy lifetime before filling frags so error
+                * rollback frees managed fixed-buffer pages through
+                * the uarg-aware path.
+                */
+               skb_zcopy_set(skb, uarg, NULL);
+
                err = virtio_transport_fill_skb(skb, info, payload_len, zcopy);
                if (err)
                        goto out;
@@ -364,6 +371,7 @@ static int virtio_transport_send_pkt_info(struct vsock_sock *vsk,
                skb_len = min(max_skb_len, rest_len);
 
                skb = virtio_transport_alloc_skb(info, skb_len, can_zcopy,
+                                                uarg,
                                                 src_cid, src_port,
                                                 dst_cid, dst_port);
                if (!skb) {
@@ -371,8 +379,6 @@ static int virtio_transport_send_pkt_info(struct vsock_sock *vsk,
                        break;
                }
 
-               skb_zcopy_set(skb, uarg, NULL);
-
                virtio_transport_inc_tx_pkt(vvs, skb);
 
                ret = t_ops->send_pkt(skb, info->net);
@@ -1183,7 +1189,7 @@ static int virtio_transport_reset_no_sock(const struct virtio_transport *t,
        if (!t)
                return -ENOTCONN;
 
-       reply = virtio_transport_alloc_skb(&info, 0, false,
+       reply = virtio_transport_alloc_skb(&info, 0, false, NULL,
                                           le64_to_cpu(hdr->dst_cid),
                                           le32_to_cpu(hdr->dst_port),
                                           le64_to_cpu(hdr->src_cid),