[PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[Yunjian Wang]

The hdr->csum_start does two successive reads from user space to read a
variable length data structure. The result overflow if the data structure
changes between the two reads.

To fix this, we can prevent double fetch issue by copying virtio_hdr to
the temporary variable.

Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
Cc: stable@dpdk.org

Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
---
 lib/vhost/virtio_net.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 69901ab3b5..5c40ae7069 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
 			 * in a contiguous virtual area.
 			 */
 			copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
-			hdr = &tmp_hdr;
 		} else {
-			hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
+			rte_memcpy((void *)(uintptr_t)&tmp_hdr,
+				(void *)(uintptr_t)buf_vec[0].buf_addr,
+				sizeof(struct virtio_net_hdr));
 		}
+		hdr = &tmp_hdr;
 	}
 
 	for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
@@ -3363,7 +3365,7 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
 {
 	uint16_t avail_idx = vq->last_avail_idx;
 	uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
-	struct virtio_net_hdr *hdr;
+	struct virtio_net_hdr hdr;
 	uintptr_t desc_addrs[PACKED_BATCH_SIZE];
 	uint16_t ids[PACKED_BATCH_SIZE];
 	uint16_t i;
@@ -3382,8 +3384,9 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
 
 	if (virtio_net_with_host_offload(dev)) {
 		vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
-			hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
-			vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
+			rte_memcpy((void *)(uintptr_t)&hdr,
+				(void *)(uintptr_t)desc_addrs[i], sizeof(struct virtio_net_hdr));
+			vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
 		}
 	}
 
-- 
2.33.0

Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[David Marchand]

On Thu, Dec 19, 2024 at 7:38 AM Yunjian Wang <wangyunjian@huawei.com> wrote:
>
> The hdr->csum_start does two successive reads from user space to read a
> variable length data structure. The result overflow if the data structure
> changes between the two reads.
>
> To fix this, we can prevent double fetch issue by copying virtio_hdr to
> the temporary variable.
>
> Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
> Cc: stable@dpdk.org
>
> Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
> ---
>  lib/vhost/virtio_net.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> index 69901ab3b5..5c40ae7069 100644
> --- a/lib/vhost/virtio_net.c
> +++ b/lib/vhost/virtio_net.c
> @@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
>                          * in a contiguous virtual area.
>                          */
>                         copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
> -                       hdr = &tmp_hdr;
>                 } else {
> -                       hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> +                       rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> +                               (void *)(uintptr_t)buf_vec[0].buf_addr,
> +                               sizeof(struct virtio_net_hdr));
>                 }
> +               hdr = &tmp_hdr;
>         }

This will need some benchmark, as I remember putting rte_memcpy in
inlined helpers had some performance impact.

Instead, I would call copy_vnet_hdr_from_desc unconditionnally, and
store in a struct virtio_net_hdr hdr variable (+ a has_vnet_hdr
boolean to indicate validity).
Something like:
        if (virtio_net_with_host_offload(dev)) {
-               if (unlikely(buf_vec[0].buf_len < sizeof(struct
virtio_net_hdr))) {
-                       /*
-                        * No luck, the virtio-net header doesn't fit
-                        * in a contiguous virtual area.
-                        */
-                       copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
-                       hdr = &tmp_hdr;
-               } else {
-                       hdr = (struct virtio_net_hdr
*)((uintptr_t)buf_vec[0].buf_addr);
-               }
+               copy_vnet_hdr_from_desc(&hdr, buf_vec);
+               has_vnet_hdr = true;
        }

(besides, in copy_vnet_hdr_from_desc, the while (cond) {} loop could
be changed to do a do {} while (cond), and that approach requires
performance numbers too)


>
>         for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
> @@ -3363,7 +3365,7 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
>  {
>         uint16_t avail_idx = vq->last_avail_idx;
>         uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
> -       struct virtio_net_hdr *hdr;
> +       struct virtio_net_hdr hdr;
>         uintptr_t desc_addrs[PACKED_BATCH_SIZE];
>         uint16_t ids[PACKED_BATCH_SIZE];
>         uint16_t i;
> @@ -3382,8 +3384,9 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
>
>         if (virtio_net_with_host_offload(dev)) {
>                 vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
> -                       hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
> -                       vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
> +                       rte_memcpy((void *)(uintptr_t)&hdr,
> +                               (void *)(uintptr_t)desc_addrs[i], sizeof(struct virtio_net_hdr));
> +                       vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
>                 }
>         }

Here too, there may be an impact with adding rte_memcpy.
Just do a copy like:

        if (virtio_net_with_host_offload(dev)) {
+               struct virtio_net_hdr hdr;
+
                vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
-                       hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
-                       vhost_dequeue_offload(dev, hdr, pkts[i],
legacy_ol_flags);
+                       hdr = *(struct virtio_net_hdr *)(desc_addrs[i]);
+                       vhost_dequeue_offload(dev, &hdr, pkts[i],
legacy_ol_flags);
                }


-- 
David Marchand

RE: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[Wangyunjian(wangyunjian,TongTu)]

> -----Original Message-----
> From: David Marchand [mailto:david.marchand@redhat.com]
> Sent: Thursday, December 19, 2024 4:24 PM
> To: Wangyunjian(wangyunjian,TongTu) <wangyunjian@huawei.com>;
> maxime.coquelin@redhat.com
> Cc: dev@dpdk.org; chenbox@nvidia.com; Lilijun (Jerry)
> <jerry.lilijun@huawei.com>; xiawei (H) <xiawei40@huawei.com>;
> wangzengyuan <wangzengyuan@huawei.com>; stable@dpdk.org
> Subject: Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
> 
> On Thu, Dec 19, 2024 at 7:38 AM Yunjian Wang <wangyunjian@huawei.com>
> wrote:
> >
> > The hdr->csum_start does two successive reads from user space to read a
> > variable length data structure. The result overflow if the data structure
> > changes between the two reads.
> >
> > To fix this, we can prevent double fetch issue by copying virtio_hdr to
> > the temporary variable.
> >
> > Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
> > ---
> >  lib/vhost/virtio_net.c | 13 ++++++++-----
> >  1 file changed, 8 insertions(+), 5 deletions(-)
> >
> > diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> > index 69901ab3b5..5c40ae7069 100644
> > --- a/lib/vhost/virtio_net.c
> > +++ b/lib/vhost/virtio_net.c
> > @@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct
> vhost_virtqueue *vq,
> >                          * in a contiguous virtual area.
> >                          */
> >                         copy_vnet_hdr_from_desc(&tmp_hdr,
> buf_vec);
> > -                       hdr = &tmp_hdr;
> >                 } else {
> > -                       hdr = (struct virtio_net_hdr
> *)((uintptr_t)buf_vec[0].buf_addr);
> > +                       rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> > +                               (void
> *)(uintptr_t)buf_vec[0].buf_addr,
> > +                               sizeof(struct virtio_net_hdr));
> >                 }
> > +               hdr = &tmp_hdr;
> >         }
> 
> This will need some benchmark, as I remember putting rte_memcpy in
> inlined helpers had some performance impact.
> 
> Instead, I would call copy_vnet_hdr_from_desc unconditionnally, and
> store in a struct virtio_net_hdr hdr variable (+ a has_vnet_hdr
> boolean to indicate validity).
> Something like:
>         if (virtio_net_with_host_offload(dev)) {
> -               if (unlikely(buf_vec[0].buf_len < sizeof(struct
> virtio_net_hdr))) {
> -                       /*
> -                        * No luck, the virtio-net header doesn't fit
> -                        * in a contiguous virtual area.
> -                        */
> -                       copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
> -                       hdr = &tmp_hdr;
> -               } else {
> -                       hdr = (struct virtio_net_hdr
> *)((uintptr_t)buf_vec[0].buf_addr);
> -               }
> +               copy_vnet_hdr_from_desc(&hdr, buf_vec);
> +               has_vnet_hdr = true;
>         }
> 
> (besides, in copy_vnet_hdr_from_desc, the while (cond) {} loop could
> be changed to do a do {} while (cond), and that approach requires
> performance numbers too)

How about this?
@@ -2904,8 +2904,8 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
        uint32_t hdr_remain = dev->vhost_hlen;
        uint32_t cpy_len;
        struct rte_mbuf *cur = m, *prev = m;
-       struct virtio_net_hdr tmp_hdr;
-       struct virtio_net_hdr *hdr = NULL;
+       bool has_vnet_hdr = false;
+       struct virtio_net_hdr hdr;
        uint16_t vec_idx;
        struct vhost_async *async = vq->async;
        struct async_inflight_info *pkts_info;
@@ -2921,11 +2921,11 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
                         * No luck, the virtio-net header doesn't fit
                         * in a contiguous virtual area.
                         */
-                       copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
-                       hdr = &tmp_hdr;
+                       copy_vnet_hdr_from_desc(&hdr, buf_vec);
                } else {
-                       hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
+                       hdr = *(struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
                }
+               has_vnet_hdr = true;
        }


> 
> 
> >
> >         for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
> > @@ -3363,7 +3365,7 @@ virtio_dev_tx_batch_packed(struct virtio_net
> *dev,
> >  {
> >         uint16_t avail_idx = vq->last_avail_idx;
> >         uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
> > -       struct virtio_net_hdr *hdr;
> > +       struct virtio_net_hdr hdr;
> >         uintptr_t desc_addrs[PACKED_BATCH_SIZE];
> >         uint16_t ids[PACKED_BATCH_SIZE];
> >         uint16_t i;
> > @@ -3382,8 +3384,9 @@ virtio_dev_tx_batch_packed(struct virtio_net
> *dev,
> >
> >         if (virtio_net_with_host_offload(dev)) {
> >                 vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
> > -                       hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
> > -                       vhost_dequeue_offload(dev, hdr, pkts[i],
> legacy_ol_flags);
> > +                       rte_memcpy((void *)(uintptr_t)&hdr,
> > +                               (void *)(uintptr_t)desc_addrs[i],
> sizeof(struct virtio_net_hdr));
> > +                       vhost_dequeue_offload(dev, &hdr, pkts[i],
> legacy_ol_flags);
> >                 }
> >         }
> 
> Here too, there may be an impact with adding rte_memcpy.
> Just do a copy like:
> 
>         if (virtio_net_with_host_offload(dev)) {
> +               struct virtio_net_hdr hdr;
> +
>                 vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
> -                       hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
> -                       vhost_dequeue_offload(dev, hdr, pkts[i],
> legacy_ol_flags);
> +                       hdr = *(struct virtio_net_hdr *)(desc_addrs[i]);
> +                       vhost_dequeue_offload(dev, &hdr, pkts[i],
> legacy_ol_flags);
>                 }
> 

Thanks for your suggestion, will include them in next version.

> 
> --
> David Marchand
> 

Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[Stephen Hemminger]

On Thu, 19 Dec 2024 14:38:28 +0800
Yunjian Wang <wangyunjian@huawei.com> wrote:

> -			hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> +			rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> +				(void *)(uintptr_t)buf_vec[0].buf_addr,
> +				sizeof(struct virtio_net_hdr));
>  		}

Do not introduce more rte_memcpy of a fixed size.
You don't need that many casts!
Why can you not use a structure assignment here.

RE: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[Wangyunjian(wangyunjian,TongTu)]

> -----Original Message-----
> From: Stephen Hemminger [mailto:stephen@networkplumber.org]
> Sent: Friday, December 20, 2024 12:16 AM
> To: Wangyunjian(wangyunjian,TongTu) <wangyunjian@huawei.com>
> Cc: dev@dpdk.org; maxime.coquelin@redhat.com; chenbox@nvidia.com;
> Lilijun (Jerry) <jerry.lilijun@huawei.com>; xiawei (H) <xiawei40@huawei.com>;
> wangzengyuan <wangzengyuan@huawei.com>; stable@dpdk.org
> Subject: Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
> 
> On Thu, 19 Dec 2024 14:38:28 +0800
> Yunjian Wang <wangyunjian@huawei.com> wrote:
> 
> > -			hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> > +			rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> > +				(void *)(uintptr_t)buf_vec[0].buf_addr,
> > +				sizeof(struct virtio_net_hdr));
> >  		}
> 
> Do not introduce more rte_memcpy of a fixed size.
> You don't need that many casts!
> Why can you not use a structure assignment here.

 The virtio_hdr is a shared component, and other fields within it are read
multiple times. This can potentially result in a double fetch scenario.

[PATCH v2 1/1] vhost: fix a double fetch when dequeue offloading

[Yunjian Wang]

The hdr->csum_start does two successive reads from user space to read a
variable length data structure. The result overflow if the data structure
changes between the two reads.

To fix this, we can prevent double fetch issue by copying virtio_hdr to
the temporary variable.

Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
Cc: stable@dpdk.org

Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
---
v2: update code styles suggested by David Marchand
---
 lib/vhost/virtio_net.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 69901ab3b5..2676447906 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2896,8 +2896,8 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
 	uint32_t hdr_remain = dev->vhost_hlen;
 	uint32_t cpy_len;
 	struct rte_mbuf *cur = m, *prev = m;
-	struct virtio_net_hdr tmp_hdr;
-	struct virtio_net_hdr *hdr = NULL;
+	bool has_vnet_hdr = false;
+	struct virtio_net_hdr hdr;
 	uint16_t vec_idx;
 	struct vhost_async *async = vq->async;
 	struct async_inflight_info *pkts_info;
@@ -2913,11 +2913,11 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
 			 * No luck, the virtio-net header doesn't fit
 			 * in a contiguous virtual area.
 			 */
-			copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
-			hdr = &tmp_hdr;
+			copy_vnet_hdr_from_desc(&hdr, buf_vec);
 		} else {
-			hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
+			hdr = *(struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
 		}
+		has_vnet_hdr = true;
 	}
 
 	for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
@@ -2953,7 +2953,7 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
 			if (async_fill_seg(dev, vq, cur, mbuf_offset,
 					   buf_iova + buf_offset, cpy_len, false) < 0)
 				goto error;
-		} else if (likely(hdr && cur == m)) {
+		} else if (likely(has_vnet_hdr && cur == m)) {
 			rte_memcpy(rte_pktmbuf_mtod_offset(cur, void *, mbuf_offset),
 				(void *)((uintptr_t)(buf_addr + buf_offset)),
 				cpy_len);
@@ -3013,10 +3013,10 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
 
 	if (is_async) {
 		async_iter_finalize(async);
-		if (hdr)
-			pkts_info[slot_idx].nethdr = *hdr;
-	} else if (hdr) {
-		vhost_dequeue_offload(dev, hdr, m, legacy_ol_flags);
+		if (has_vnet_hdr)
+			pkts_info[slot_idx].nethdr = hdr;
+	} else if (has_vnet_hdr) {
+		vhost_dequeue_offload(dev, &hdr, m, legacy_ol_flags);
 	}
 
 	return 0;
@@ -3363,7 +3363,6 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
 {
 	uint16_t avail_idx = vq->last_avail_idx;
 	uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
-	struct virtio_net_hdr *hdr;
 	uintptr_t desc_addrs[PACKED_BATCH_SIZE];
 	uint16_t ids[PACKED_BATCH_SIZE];
 	uint16_t i;
@@ -3381,9 +3380,11 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
 			   pkts[i]->pkt_len);
 
 	if (virtio_net_with_host_offload(dev)) {
+		struct virtio_net_hdr hdr;
+
 		vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
-			hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
-			vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
+			hdr = *(struct virtio_net_hdr *)(desc_addrs[i]);
+			vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
 		}
 	}
 
-- 
2.33.0

Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[Stephen Hemminger]

On Fri, 20 Dec 2024 02:17:12 +0000
"Wangyunjian(wangyunjian,TongTu)" <wangyunjian@huawei.com> wrote:

> > -----Original Message-----
> > From: Stephen Hemminger [mailto:stephen@networkplumber.org]
> > Sent: Friday, December 20, 2024 12:16 AM
> > To: Wangyunjian(wangyunjian,TongTu) <wangyunjian@huawei.com>
> > Cc: dev@dpdk.org; maxime.coquelin@redhat.com; chenbox@nvidia.com;
> > Lilijun (Jerry) <jerry.lilijun@huawei.com>; xiawei (H) <xiawei40@huawei.com>;
> > wangzengyuan <wangzengyuan@huawei.com>; stable@dpdk.org
> > Subject: Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
> > 
> > On Thu, 19 Dec 2024 14:38:28 +0800
> > Yunjian Wang <wangyunjian@huawei.com> wrote:
> >   
> > > -			hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> > > +			rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> > > +				(void *)(uintptr_t)buf_vec[0].buf_addr,
> > > +				sizeof(struct virtio_net_hdr));
> > >  		}  
> > 
> > Do not introduce more rte_memcpy of a fixed size.
> > You don't need that many casts!
> > Why can you not use a structure assignment here.  
> 
>  The virtio_hdr is a shared component, and other fields within it are read
> multiple times. This can potentially result in a double fetch scenario.


The point is do a copy, but not with rte_memcpy.
Also you need a rte_compiler_barrier() anyway.

Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[Stephen Hemminger]

On Thu, 19 Dec 2024 14:38:28 +0800
Yunjian Wang <wangyunjian@huawei.com> wrote:

> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> index 69901ab3b5..5c40ae7069 100644
> --- a/lib/vhost/virtio_net.c
> +++ b/lib/vhost/virtio_net.c
> @@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
>  			 * in a contiguous virtual area.
>  			 */
>  			copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
> -			hdr = &tmp_hdr;
>  		} else {
> -			hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> +			rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> +				(void *)(uintptr_t)buf_vec[0].buf_addr,
> +				sizeof(struct virtio_net_hdr));
>  		}
> +		hdr = &tmp_hdr;

Since this if block is just an optimization of the case where vnet header
is contiguous why not just always use copy_vnet_hdr_from_desc? and inline it?

Re: [PATCH v2 1/1] vhost: fix a double fetch when dequeue offloading

[Stephen Hemminger]

On Fri, 20 Dec 2024 11:49:55 +0800
Yunjian Wang <wangyunjian@huawei.com> wrote:

> The hdr->csum_start does two successive reads from user space to read a
> variable length data structure. The result overflow if the data structure
> changes between the two reads.
> 
> To fix this, we can prevent double fetch issue by copying virtio_hdr to
> the temporary variable.
> 
> Fixes: 4dc4e33ffa10 ("net/virtio: fix Rx checksum calculation")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>


How about something like the following *untested*

diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 69901ab3b5..c65cb639b2 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2861,25 +2861,28 @@ vhost_dequeue_offload(struct virtio_net *dev, struct virtio_net_hdr *hdr,
 	}
 }
 
-static __rte_noinline void
+static inline int
 copy_vnet_hdr_from_desc(struct virtio_net_hdr *hdr,
-		struct buf_vector *buf_vec)
+			const struct buf_vector *buf_vec,
+			uint16_t nr_vec)
 {
-	uint64_t len;
-	uint64_t remain = sizeof(struct virtio_net_hdr);
-	uint64_t src;
-	uint64_t dst = (uint64_t)(uintptr_t)hdr;
+	size_t remain = sizeof(struct virtio_net_hdr);
+	uint8_t *dst = (uint8_t *)hdr;
 
-	while (remain) {
-		len = RTE_MIN(remain, buf_vec->buf_len);
-		src = buf_vec->buf_addr;
-		rte_memcpy((void *)(uintptr_t)dst,
-				(void *)(uintptr_t)src, len);
+	while (remain > 0) {
+		size_t len = RTE_MIN(remain, buf_vec->buf_len);
+		const void *src = (const void *)(uintptr_t)buf_vec->buf_addr;
 
+		if (unlikely(nr_vec == 0))
+			return -1;
+
+		memcpy(dst, src, len);
 		remain -= len;
 		dst += len;
 		buf_vec++;
+		--nr_vec;
 	}
+	return 0;
 }
 
 static __rte_always_inline int
@@ -2908,16 +2911,12 @@ desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
 	 */
 
 	if (virtio_net_with_host_offload(dev)) {
-		if (unlikely(buf_vec[0].buf_len < sizeof(struct virtio_net_hdr))) {
-			/*
-			 * No luck, the virtio-net header doesn't fit
-			 * in a contiguous virtual area.
-			 */
-			copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
-			hdr = &tmp_hdr;
-		} else {
-			hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
-		}
+		if (unlikely(copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec, nr_vec) != 0))
+		    return -1;
+
+		/* ensure that compiler does not delay copy */
+		rte_compiler_barrier();
+		hdr = &tmp_hdr;
 	}
 
 	for (vec_idx = 0; vec_idx < nr_vec; vec_idx++) {
@@ -3363,7 +3362,6 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
 {
 	uint16_t avail_idx = vq->last_avail_idx;
 	uint32_t buf_offset = sizeof(struct virtio_net_hdr_mrg_rxbuf);
-	struct virtio_net_hdr *hdr;
 	uintptr_t desc_addrs[PACKED_BATCH_SIZE];
 	uint16_t ids[PACKED_BATCH_SIZE];
 	uint16_t i;
@@ -3382,8 +3380,12 @@ virtio_dev_tx_batch_packed(struct virtio_net *dev,
 
 	if (virtio_net_with_host_offload(dev)) {
 		vhost_for_each_try_unroll(i, 0, PACKED_BATCH_SIZE) {
-			hdr = (struct virtio_net_hdr *)(desc_addrs[i]);
-			vhost_dequeue_offload(dev, hdr, pkts[i], legacy_ol_flags);
+			struct virtio_net_hdr hdr;
+
+			memcpy(&hdr, (void *)desc_addrs[i], sizeof(struct virtio_net_hdr));
+			rte_compiler_barrier();
+
+			vhost_dequeue_offload(dev, &hdr, pkts[i], legacy_ol_flags);
 		}
 	}
 

RE: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading

[Wangyunjian(wangyunjian,TongTu)]

> -----Original Message-----
> From: Stephen Hemminger [mailto:stephen@networkplumber.org]
> Sent: Saturday, December 21, 2024 12:36 AM
> To: Wangyunjian(wangyunjian,TongTu) <wangyunjian@huawei.com>
> Cc: dev@dpdk.org; maxime.coquelin@redhat.com; chenbox@nvidia.com;
> Lilijun (Jerry) <jerry.lilijun@huawei.com>; xiawei (H) <xiawei40@huawei.com>;
> wangzengyuan <wangzengyuan@huawei.com>; stable@dpdk.org
> Subject: Re: [PATCH 1/1] vhost: fix a double fetch when dequeue offloading
> 
> On Thu, 19 Dec 2024 14:38:28 +0800
> Yunjian Wang <wangyunjian@huawei.com> wrote:
> 
> > diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> > index 69901ab3b5..5c40ae7069 100644
> > --- a/lib/vhost/virtio_net.c
> > +++ b/lib/vhost/virtio_net.c
> > @@ -2914,10 +2914,12 @@ desc_to_mbuf(struct virtio_net *dev, struct
> vhost_virtqueue *vq,
> >  			 * in a contiguous virtual area.
> >  			 */
> >  			copy_vnet_hdr_from_desc(&tmp_hdr, buf_vec);
> > -			hdr = &tmp_hdr;
> >  		} else {
> > -			hdr = (struct virtio_net_hdr *)((uintptr_t)buf_vec[0].buf_addr);
> > +			rte_memcpy((void *)(uintptr_t)&tmp_hdr,
> > +				(void *)(uintptr_t)buf_vec[0].buf_addr,
> > +				sizeof(struct virtio_net_hdr));
> >  		}
> > +		hdr = &tmp_hdr;
> 
> Since this if block is just an optimization of the case where vnet header
> is contiguous why not just always use copy_vnet_hdr_from_desc? and inline it?

I also considered using the copy_vnet_hdr_from_desc function directly.
However, in most cases, the vnet header is continuous, and reusing
copy_vnet_hdr_from_desc results in additional operations.

Thanks,
Yunjian