You can reproduce this with l2fwd and the vhost PMD. You'll need this patch on top of the vhost PMD patches: --- a/lib/librte_vhost/virtio-net.c +++ b/lib/librte_vhost/virtio-net.c @@ -471,7 +471,7 @@ reset_owner(struct vhost_device_ctx ctx) return -1;
if (dev->flags & VIRTIO_DEV_RUNNING) - notify_ops->destroy_device(dev); + notify_destroy_device(dev); cleanup_device(dev); reset_device(dev); 1. Start l2fwd on the host: l2fwd -l 0,1 --vdev eth_null --vdev eth_vhost0,iface=/run/vhost0.sock -- -p3 2. Start a VM using vhost-user and set up uio, hugepages, etc. 3. Start l2fwd inside the VM: l2fwd -l 0,1 --vdev eth_null -- -p3 4. Kill the l2fwd inside the VM with SIGINT. 5. Start l2fwd inside the VM. 6. l2fwd on the host crashes. I found the source of the memory corruption by setting a watchpoint in gdb: watch -l rte_eth_devices[1].data->rx_queues On Thu, Nov 12, 2015 at 1:23 AM, Yuanhan Liu <yuanhan.liu at linux.intel.com> wrote: > On Thu, Nov 12, 2015 at 12:02:33AM -0800, Rich Lane wrote: > > The guest could trigger this buffer overflow by creating a cycle of > descriptors > > (which would also cause an infinite loop). The more common case is that > > vq->avail->idx jumps out of the range [last_used_idx, > last_used_idx+256). This > > happens nearly every time when restarting a DPDK app inside a VM > connected to a > > vhost-user vswitch because the virtqueue memory allocated by the > previous run > > is zeroed. > > Hi, > > I somehow was aware of this issue before while reading the code. > Thinking that we never met that, I delayed the fix (it was still > in my TODO list). > > Would you please tell me the steps (commands would be better) to > reproduce your issue? I'd like to know more about the isue: I'm > guessing maybe we need fix it with a bit more cares. > > --yliu > > > > Signed-off-by: Rich Lane <rlane at bigswitch.com> > > --- > > lib/librte_vhost/vhost_rxtx.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/lib/librte_vhost/vhost_rxtx.c > b/lib/librte_vhost/vhost_rxtx.c > > index 9322ce6..d95b478 100644 > > --- a/lib/librte_vhost/vhost_rxtx.c > > +++ b/lib/librte_vhost/vhost_rxtx.c > > @@ -453,7 +453,7 @@ update_secure_len(struct vhost_virtqueue *vq, > uint32_t id, > > vq->buf_vec[vec_id].desc_idx = idx; > > vec_id++; > > > > - if (vq->desc[idx].flags & VRING_DESC_F_NEXT) { > > + if (vq->desc[idx].flags & VRING_DESC_F_NEXT && vec_id < > BUF_VECTOR_MAX) { > > idx = vq->desc[idx].next; > > next_desc = 1; > > } > > -- > > 1.9.1 >