Fw:[PATCH v2] vhost: fix avail idx update error when desc copy failed

Fw:[PATCH v2] vhost: fix avail idx update error when desc copy failed

[Gaoxiang Liu]

[-- Attachment #1: Type: text/plain, Size: 1682 bytes --]




Hi, Chen bo, Maxime,
     Please help to review the patch below.
Thanks.
Gaoxiang.
-------- Forwarding messages --------
From: "Gaoxiang Liu" <gaoxiangliu0@163.com>
Date: 2022-06-22 09:19:44
To:  maxime.coquelin@redhat.com,chenbo.xia@intel.com
Cc:  dev@dpdk.org,liugaoxiang@huawei.com,"Gaoxiang Liu" <gaoxiangliu0@163.com>,stable@dpdk.org
Subject: [PATCH v2] vhost: fix avail idx update error when desc copy failed
When copy_desc_to_mbuf function failed, i added 1.
And last_avail_idx added i, other than i - 1.
It may cause that the first mbuf in mbuf-list is dropped,
the second mbuf in mbuf-list is received in the following
rx procedure.
And The pkt_len of the second mbuf is zero, resulting in
segment fault when parsing the mbuf.

Fixes: 0fd5608ef97f ("vhost: handle mbuf allocation failure")
Cc: stable@dpdk.org

Signed-off-by: Gaoxiang Liu <liugaoxiang@huawei.com>

---
v2:
* Fixed other idx update errors.
---
 lib/vhost/virtio_net.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 68a26eb17d..eb254e1024 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2850,11 +2850,11 @@ virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
 	if (dropped)
 		rte_pktmbuf_free_bulk(&pkts[i - 1], count - i + 1);
 
-	vq->last_avail_idx += i;
+	vq->last_avail_idx += i - dropped;
 
 	do_data_copy_dequeue(vq);
-	if (unlikely(i < count))
-		vq->shadow_used_idx = i;
+	if (unlikely((i - dropped) < count))
+		vq->shadow_used_idx = i - dropped;
 	if (likely(vq->shadow_used_idx)) {
 		flush_shadow_used_ring_split(dev, vq);
 		vhost_vring_call_split(dev, vq);
-- 
2.32.0

[-- Attachment #2: Type: text/html, Size: 1976 bytes --]

RE: Fw:[PATCH v2] vhost: fix avail idx update error when desc copy failed

[Xia, Chenbo]

Hi Gaoxiang,

> From: Gaoxiang Liu <gaoxiangliu0@163.com> 
> Sent: Wednesday, June 22, 2022 10:30 PM
> To: Xia, Chenbo <chenbo.xia@intel.com>; maxime.coquelin@redhat.com
> Cc: dev@dpdk.org
> Subject: Fw:[PATCH v2] vhost: fix avail idx update error when desc copy failed
> 
> 
> Hi, Chen bo, Maxime,
>      Please help to review the patch below.


Maxime or I will review it when we have time. But please note that you sent the patch multiple times and did not update the version. So patchwork shows multiple patches and we will need to check which one is the latest. This will of course increase our overhead to review.

Please update the version number or update the patchwork next time. This will also help your patch get reviewed ASAP.

Thanks,
Chenbo

> Thanks.
> Gaoxiang.
-------- Forwarding messages --------
From: "Gaoxiang Liu" <mailto:gaoxiangliu0@163.com>
Date: 2022-06-22 09:19:44
To:  mailto:maxime.coquelin@redhat.com,chenbo.xia@intel.com
Cc:  mailto:dev@dpdk.org,liugaoxiang@huawei.com,"Gaoxiang Liu" <mailto:gaoxiangliu0@163.com>,stable@dpdk.org
Subject: [PATCH v2] vhost: fix avail idx update error when desc copy failed
When copy_desc_to_mbuf function failed, i added 1.
And last_avail_idx added i, other than i - 1.
It may cause that the first mbuf in mbuf-list is dropped,
the second mbuf in mbuf-list is received in the following
rx procedure.
And The pkt_len of the second mbuf is zero, resulting in
segment fault when parsing the mbuf.

Fixes: 0fd5608ef97f ("vhost: handle mbuf allocation failure")
Cc: mailto:stable@dpdk.org

Signed-off-by: Gaoxiang Liu <mailto:liugaoxiang@huawei.com>

---
v2:
* Fixed other idx update errors.
---
 lib/vhost/virtio_net.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
index 68a26eb17d..eb254e1024 100644
--- a/lib/vhost/virtio_net.c
+++ b/lib/vhost/virtio_net.c
@@ -2850,11 +2850,11 @@ virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq,
 	if (dropped)
 		rte_pktmbuf_free_bulk(&pkts[i - 1], count - i + 1);
 
-	vq->last_avail_idx += i;
+	vq->last_avail_idx += i - dropped;
 
 	do_data_copy_dequeue(vq);
-	if (unlikely(i < count))
-		vq->shadow_used_idx = i;
+	if (unlikely((i - dropped) < count))
+		vq->shadow_used_idx = i - dropped;
 	if (likely(vq->shadow_used_idx)) {
 		flush_shadow_used_ring_split(dev, vq);
 		vhost_vring_call_split(dev, vq);
-- 
2.32.0