From: "Xia, Chenbo" <chenbo.xia@intel.com>
To: "Jiang, Cheng1" <cheng1.jiang@intel.com>,
"maxime.coquelin@redhat.com" <maxime.coquelin@redhat.com>
Cc: "dev@dpdk.org" <dev@dpdk.org>, "Hu, Jiayu" <jiayu.hu@intel.com>,
"Yang, YvonneX" <yvonnex.yang@intel.com>,
"stable@dpdk.org" <stable@dpdk.org>
Subject: Re: [dpdk-stable] [PATCH v2] vhost: fix index overflow for packed ring in async vhost
Date: Fri, 16 Jul 2021 02:30:50 +0000 [thread overview]
Message-ID: <MN2PR11MB40632C12A18807D7DB44E1429C119@MN2PR11MB4063.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20210715095030.55454-1-cheng1.jiang@intel.com>
> -----Original Message-----
> From: Jiang, Cheng1 <cheng1.jiang@intel.com>
> Sent: Thursday, July 15, 2021 5:51 PM
> To: maxime.coquelin@redhat.com; Xia, Chenbo <chenbo.xia@intel.com>
> Cc: dev@dpdk.org; Hu, Jiayu <jiayu.hu@intel.com>; Yang, YvonneX
> <yvonnex.yang@intel.com>; Jiang, Cheng1 <cheng1.jiang@intel.com>;
> stable@dpdk.org
> Subject: [PATCH v2] vhost: fix index overflow for packed ring in async vhost
>
> We introduced some new indexes in packed ring of async vhost. They
> will eventually overflow and lead to errors if the ring size is not
> a power of 2. This patch is to check and keep these indexes within a
> reasonable range.
>
> Fixes: 873e8dad6f49 ("vhost: support packed ring in async datapath")
> Cc: stable@dpdk.org
>
> Signed-off-by: Cheng Jiang <cheng1.jiang@intel.com>
> ---
> lib/vhost/virtio_net.c | 21 ++++++++++++++-------
> 1 file changed, 14 insertions(+), 7 deletions(-)
>
> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
> index f4a2c88d8b..bfb2bf8fc4 100644
> --- a/lib/vhost/virtio_net.c
> +++ b/lib/vhost/virtio_net.c
> @@ -2036,7 +2036,7 @@ virtio_dev_rx_async_submit_packed(struct virtio_net *dev,
>
> slot_idx = (vq->async_pkts_idx + num_async_pkts) % vq->size;
> if (it_pool[it_idx].count) {
> - uint16_t from, to;
> + uint16_t from;
>
> async_descs_idx += num_descs;
> async_fill_desc(&tdes[pkt_burst_idx++],
> @@ -2055,11 +2055,13 @@ virtio_dev_rx_async_submit_packed(struct virtio_net
> *dev,
> * descriptors.
> */
> from = vq->shadow_used_idx - num_buffers;
> - to = vq->async_buffer_idx_packed % vq->size;
> store_dma_desc_info_packed(vq->shadow_used_packed,
> - vq->async_buffers_packed, vq->size, from, to,
> num_buffers);
> + vq->async_buffers_packed, vq->size, from,
> + vq->async_buffer_idx_packed, num_buffers);
>
> vq->async_buffer_idx_packed += num_buffers;
> + if (vq->async_buffer_idx_packed >= vq->size)
> + vq->async_buffer_idx_packed -= vq->size;
> vq->shadow_used_idx -= num_buffers;
> } else {
> comp_pkts[num_done_pkts++] = pkts[pkt_idx];
> @@ -2112,6 +2114,8 @@ virtio_dev_rx_async_submit_packed(struct virtio_net *dev,
> dma_error_handler_packed(vq, async_descs, async_descs_idx,
> slot_idx, pkt_err,
> &pkt_idx, &num_async_pkts, &num_done_pkts);
> vq->async_pkts_idx += num_async_pkts;
> + if (vq->async_pkts_idx >= vq->size)
> + vq->async_pkts_idx -= vq->size;
> *comp_count = num_done_pkts;
>
> if (likely(vq->shadow_used_idx)) {
> @@ -2160,7 +2164,7 @@ write_back_completed_descs_packed(struct vhost_virtqueue
> *vq,
> uint16_t from, to;
>
> do {
> - from = vq->last_async_buffer_idx_packed % vq->size;
> + from = vq->last_async_buffer_idx_packed;
> to = (from + nr_left) % vq->size;
> if (to > from) {
> vhost_update_used_packed(vq, vq->async_buffers_packed + from,
> to - from);
> @@ -2169,7 +2173,7 @@ write_back_completed_descs_packed(struct vhost_virtqueue
> *vq,
> } else {
> vhost_update_used_packed(vq, vq->async_buffers_packed + from,
> vq->size - from);
> - vq->last_async_buffer_idx_packed += vq->size - from;
> + vq->last_async_buffer_idx_packed = 0;
> nr_left -= vq->size - from;
> }
> } while (nr_left > 0);
> @@ -2252,10 +2256,13 @@ uint16_t rte_vhost_poll_enqueue_completed(int vid,
> uint16_t queue_id,
> vhost_vring_call_split(dev, vq);
> }
> } else {
> - if (vq_is_packed(dev))
> + if (vq_is_packed(dev)) {
> vq->last_async_buffer_idx_packed += n_buffers;
> - else
> + if (vq->last_async_buffer_idx_packed >= vq->size)
> + vq->last_async_buffer_idx_packed -= vq->size;
> + } else {
> vq->last_async_desc_idx_split += n_descs;
> + }
> }
>
> done:
> --
> 2.29.2
Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>
next prev parent reply other threads:[~2021-07-16 2:31 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-08 10:44 [dpdk-stable] [PATCH] vhost: fix index overflow issue " Cheng Jiang
2021-07-15 8:37 ` Xia, Chenbo
2021-07-15 8:50 ` Jiang, Cheng1
2021-07-15 9:50 ` [dpdk-stable] [PATCH v2] vhost: fix index overflow for packed ring " Cheng Jiang
2021-07-16 2:30 ` Xia, Chenbo [this message]
2021-07-20 2:44 ` Xia, Chenbo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=MN2PR11MB40632C12A18807D7DB44E1429C119@MN2PR11MB4063.namprd11.prod.outlook.com \
--to=chenbo.xia@intel.com \
--cc=cheng1.jiang@intel.com \
--cc=dev@dpdk.org \
--cc=jiayu.hu@intel.com \
--cc=maxime.coquelin@redhat.com \
--cc=stable@dpdk.org \
--cc=yvonnex.yang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).