Re: [PATCH net 1/2] vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy

[Arseniy Krasnov]

02.04.2026 11:18, Luigi Leonardi wrote:
> `virtio_transport_stream_do_peek()` does not account for the skb offset
> when computing the number of bytes to copy.
> 
> This means that, after a partial recv() that advances the offset, a peek
> requesting more bytes than are available in the sk_buff causes
> `skb_copy_datagram_iter()` to go past the valid payload, resulting in a -EFAULT.
> 
> The dequeue path already handles this correctly.
> Apply the same logic to the peek path.
> 
> Fixes: 0df7cd3c13e4 ("vsock/virtio/vhost: read data from non-linear skb")
> Signed-off-by: Luigi Leonardi <leonardi@xxxxxxxxxx>
> ---
>  net/vmw_vsock/virtio_transport_common.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
> index 8a9fb23c6e853dfea0a24d3787f7d6eb351dd6c6..4b65bfe5d875111f115e0fc4c6727adb66f34830 100644
> --- a/net/vmw_vsock/virtio_transport_common.c
> +++ b/net/vmw_vsock/virtio_transport_common.c
> @@ -547,9 +547,8 @@ virtio_transport_stream_do_peek(struct vsock_sock *vsk,
>  	skb_queue_walk(&vvs->rx_queue, skb) {
>  		size_t bytes;
>  
> -		bytes = len - total;
> -		if (bytes > skb->len)
> -			bytes = skb->len;
> +		bytes = min_t(size_t, len - total,
> +			      skb->len - VIRTIO_VSOCK_SKB_CB(skb)->offset);
>  
>  		spin_unlock_bh(&vvs->rx_lock);
>  
> 

Acked-by: Arseniy Krasnov <avkrasnov@xxxxxxxxxxxxxxxxx>