Hi Gaoxiang, > From: Gaoxiang Liu <[email protected]> > Sent: Wednesday, June 22, 2022 10:30 PM > To: Xia, Chenbo <[email protected]>; [email protected] > Cc: [email protected] > Subject: Fw:[PATCH v2] vhost: fix avail idx update error when desc copy failed > > > Hi, Chen bo, Maxime, > Please help to review the patch below.
Maxime or I will review it when we have time. But please note that you sent the patch multiple times and did not update the version. So patchwork shows multiple patches and we will need to check which one is the latest. This will of course increase our overhead to review. Please update the version number or update the patchwork next time. This will also help your patch get reviewed ASAP. Thanks, Chenbo > Thanks. > Gaoxiang. -------- Forwarding messages -------- From: "Gaoxiang Liu" <mailto:[email protected]> Date: 2022-06-22 09:19:44 To: mailto:[email protected],[email protected] Cc: mailto:[email protected],[email protected],"Gaoxiang Liu" <mailto:[email protected]>,[email protected] Subject: [PATCH v2] vhost: fix avail idx update error when desc copy failed When copy_desc_to_mbuf function failed, i added 1. And last_avail_idx added i, other than i - 1. It may cause that the first mbuf in mbuf-list is dropped, the second mbuf in mbuf-list is received in the following rx procedure. And The pkt_len of the second mbuf is zero, resulting in segment fault when parsing the mbuf. Fixes: 0fd5608ef97f ("vhost: handle mbuf allocation failure") Cc: mailto:[email protected] Signed-off-by: Gaoxiang Liu <mailto:[email protected]> --- v2: * Fixed other idx update errors. --- lib/vhost/virtio_net.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c index 68a26eb17d..eb254e1024 100644 --- a/lib/vhost/virtio_net.c +++ b/lib/vhost/virtio_net.c @@ -2850,11 +2850,11 @@ virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq, if (dropped) rte_pktmbuf_free_bulk(&pkts[i - 1], count - i + 1); - vq->last_avail_idx += i; + vq->last_avail_idx += i - dropped; do_data_copy_dequeue(vq); - if (unlikely(i < count)) - vq->shadow_used_idx = i; + if (unlikely((i - dropped) < count)) + vq->shadow_used_idx = i - dropped; if (likely(vq->shadow_used_idx)) { flush_shadow_used_ring_split(dev, vq); vhost_vring_call_split(dev, vq); -- 2.32.0
