From: Luigi Leonardi Date: Wed, 15 Apr 2026 15:09:28 +0000 (+0200) Subject: vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy X-Git-Tag: v7.1-rc1~36^2~62^2~2 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=080f22f5d30233faf3d83be3098f35b8be9b7a00;p=thirdparty%2Fkernel%2Flinux.git vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy `virtio_transport_stream_do_peek()` does not account for the skb offset when computing the number of bytes to copy. This means that, after a partial recv() that advances the offset, a peek requesting more bytes than are available in the sk_buff causes `skb_copy_datagram_iter()` to go past the valid payload, resulting in a -EFAULT. The dequeue path already handles this correctly. Apply the same logic to the peek path. Fixes: 0df7cd3c13e4 ("vsock/virtio/vhost: read data from non-linear skb") Reviewed-by: Stefano Garzarella Acked-by: Arseniy Krasnov Signed-off-by: Luigi Leonardi Link: https://patch.msgid.link/20260415-fix_peek-v4-1-8207e872759e@redhat.com Signed-off-by: Jakub Kicinski --- diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index e96e9893b21b..0742091beae7 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -545,9 +545,8 @@ virtio_transport_stream_do_peek(struct vsock_sock *vsk, skb_queue_walk(&vvs->rx_queue, skb) { size_t bytes; - bytes = len - total; - if (bytes > skb->len) - bytes = skb->len; + bytes = min_t(size_t, len - total, + skb->len - VIRTIO_VSOCK_SKB_CB(skb)->offset); spin_unlock_bh(&vvs->rx_lock);