[PATCH net 0/3] vsock/virtio: bound what a peer can make the host queue

[Oleg Drokin]

A virtio-vsock peer that does not consume what it is sent can make the
local side queue memory that no limit covers. On a host the peer is a
guest, and the memory is GFP_KERNEL, charged to no memory cgroup. Two
ways remain on net/main:

 - the send credit trusts the fwd_cnt the peer reports, so a peer that
   never reads but keeps acknowledging gets unlimited credit (patch 2);
 - credit updates are not bounded at all: a peer can solicit them with
   OP_CREDIT_REQUEST, or by sending small packets that a reader drains,
   while posting no rx buffers (patch 3).

Patch 1 fixes the accounting of packets that vhost drops on rx errors;
patch 2 relies on bytes_unsent being right.

Nothing changes on the wire.

Tested in an x86_64 qemu/KVM guest running the kernel under test
(net/main 03897066069f); the "guest" is a user-space program driving
/dev/vhost-vsock directly, talking to plain AF_VSOCK host sockets:

  case                                      net/main      this series
  lying fwd_cnt, no rx buffers, 2 s of      256 MiB       256 KiB
  non-blocking send() on one socket         queued        (one window)
  20000 OP_CREDIT_REQUEST, no rx buffers    +18.5 MiB     +0
  20000 1-byte packets, each read by host   +18.0 MiB     +24 KiB

vsock_test from tools/testing/vsock passes over loopback and between a
nested guest and its host. A bidirectional stress test (up to 512
connections streaming both ways, readers draining in small reads) runs
without stalls, and vsock_perf throughput stays within run-to-run noise.
With KASAN and lockdep enabled, these tests show no reports.

The reproducer (a small user-space program that drives /dev/vhost-vsock
as the guest) is available on request.

The patches, the test setup and these changelogs were prepared with an
AI coding assistant (Claude); the tests above were run as described.

Oleg Drokin (3):
  vhost/vsock: release the accounting of packets dropped on rx errors
  vsock/virtio: bound the send credit by bytes not yet consumed by the
    transport
  vsock/virtio: queue at most one credit update per socket

 drivers/vhost/vsock.c                   | 25 +++++++--
 include/linux/virtio_vsock.h            |  5 ++
 net/vmw_vsock/virtio_transport.c        |  2 +
 net/vmw_vsock/virtio_transport_common.c | 69 +++++++++++++++++++++++--
 net/vmw_vsock/vsock_loopback.c          |  1 +
 5 files changed, 95 insertions(+), 7 deletions(-)

-- 
2.56.0