<div>Hi£¬Chenbo</div><div><br></div><div>If vhost driver receives a mbuf list£¬the mbuf list has two mbuf£¬</div><div>and the pkt_len of the first mbuf in the mbuf list is the sum of data_len of all mbuf£¬and the pkt_len of the second mbuf is 0.</div><div>When desc_to_mbuf failed£¬i added 1 and last_avail_idx added i.<br></div><div>It may cause the first mbuf to be dropped and the second mbuf to be received.</div><div>It is abnormal£¬because the received mbuf is not</div><div>complete due to lack of the first mbuf£¬and its pkt_len is 0.</div><div>Because the sender sends a normal mbuf-list packet£¬the vhost app receives the mbuf and considers it should be a normal pkt.</div><div>The pkt_len is used £¬but is not checked£¬when the vhost app calculates the checksum of the pkt.</div><div>The pkt_len minus the length of the UDP header is a large value because of the negative number reverse.</div><div>It results in segment fault when the vhost app uses the large value to traverse the mbuf £¬if the address of the mbuf is largest in all mbuf£¬because the vhost app may access invalid memory .</div><div><br></div><div>Thanks.</div><div>Gaoxiang</div><div><br></div><div><br></div><div><br><br><div id="imail_signature"></div><div class="ntes-mailmaster-quote" style="padding-top: 1px; padding-bottom: 1px"><div style="margin-top: 2em;margin-bottom: 1em;font-size: 14px;line-height: 1.25;color: #78787a;">---- Replied Message ----</div><div style="margin-bottom: 1em;font-size: 12px;line-height: 1.25;color: #232324;padding: 0.5em 0.25em;border-radius: 0.67em;background-color: #f0f0f0;"><table width="100%" cellpadding="0" cellspacing="9" border="0"><tbody><tr><td valign="top" style="width: 4.25em;font-size: 12px;line-height: 1.25;color: #78787a;"><span style="color:#8b8d94">From</span></td><td valign="top" style="font-size: 12px;line-height: 1.25;color: #232324;word-break: break-all;"><a class="mail-from" style="color: #0886e8; text-decoration: none" href="mailto:chenbo.xia@intel.com">Xia, Chenbo<chenbo.xia@intel.com></a></td></tr><tr><td valign="top" style="width: 4.25em;font-size: 12px;line-height: 1.25;color: #78787a;"><span style="color:#8b8d94">Date</span></td><td class="mail-date" valign="top" style="font-size: 12px;line-height: 1.25;color: #232324;word-break: break-all;"><span class="mail-date" style="color:black">07/01/2022 21:05</span></td></tr><tr><td valign="top" style="width: 4.25em;font-size: 12px;line-height: 1.25;color: #78787a;"> <span style="color:#8b8d94">To</span></td><td valign="top" style="font-size: 12px;line-height: 1.25;color: #232324;word-break: break-all;"><a class="mail-to" style="color: #0886e8; text-decoration: none" href="mailto:gaoxiangliu0@163.com">Gaoxiang Liu<gaoxiangliu0@163.com></a>,<br><a class="mail-to" style="color: #0886e8; text-decoration: none" href="mailto:maxime.coquelin@redhat.com">maxime.coquelin@redhat.com<maxime.coquelin@redhat.com></a></td></tr><tr><td valign="top" style="width: 4.25em;font-size: 12px;line-height: 1.25;color: #78787a;"> <span style="color:#8b8d94">Cc</span></td><td valign="top" style="font-size: 12px;line-height: 1.25;color: #232324;word-break: break-all;"><a class="mail-cc" style="color: #0886e8; text-decoration: none" href="mailto:dev@dpdk.org">dev@dpdk.org<dev@dpdk.org></a>,<br><a class="mail-cc" style="color: #0886e8; text-decoration: none" href="mailto:liugaoxiang@huawei.com">liugaoxiang@huawei.com<liugaoxiang@huawei.com></a>,<br><a class="mail-cc" style="color: #0886e8; text-decoration: none" href="mailto:stable@dpdk.org">stable@dpdk.org<stable@dpdk.org></a></td></tr><tr><td valign="top" style="width: 4.25em;font-size: 12px;line-height: 1.25;color: #78787a;"><span style="color:#8b8d94">Subject</span></td><td class="mail-subject" valign="top" style="font-size: 12px;line-height: 1.25;color: #232324;word-break: break-all;"><span class="mail-subject" style="color:black">RE: [PATCH v2] vhost: fix avail idx update error when desc copy failed</span></td></tr></tbody></table></div><div>> -----Original Message-----
<br>> From: Gaoxiang Liu <gaoxiangliu0@163.com>
<br>> Sent: Wednesday, June 22, 2022 9:20 AM
<br>> To: maxime.coquelin@redhat.com; Xia, Chenbo <chenbo.xia@intel.com>
<br>> Cc: dev@dpdk.org; liugaoxiang@huawei.com; Gaoxiang Liu
<br>> <gaoxiangliu0@163.com>; stable@dpdk.org
<br>> Subject: [PATCH v2] vhost: fix avail idx update error when desc copy
<br>> failed
<br>>
<br>> When copy_desc_to_mbuf function failed, i added 1.
<br>
<br>Function name now is desc_to_mbuf
<br>
<br>> And last_avail_idx added i, other than i - 1.
<br>> It may cause that the first mbuf in mbuf-list is dropped,
<br>> the second mbuf in mbuf-list is received in the following
<br>> rx procedure.
<br>> And The pkt_len of the second mbuf is zero, resulting in
<br>> segment fault when parsing the mbuf.
<br>
<br>Could you help elaborate more? Do you mean first mbuf len is zero
<br>as it's dropped? And where does the segfault happen? APP? Please
<br>describe more to help understand the issue.
<br>
<br>But I do notice one problem here is if vhost APP does not handle
<br>the mbuf array correctly, some packets will be missed in the case
<br>of pkts got dropped in the middle of a burst.
<br>
<br>Thanks,
<br>Chenbo
<br>
<br>>
<br>> Fixes: 0fd5608ef97f ("vhost: handle mbuf allocation failure")
<br>> Cc: stable@dpdk.org
<br>>
<br>> Signed-off-by: Gaoxiang Liu <liugaoxiang@huawei.com>
<br>>
<br>> ---
<br>> v2:
<br>> * Fixed other idx update errors.
<br>> ---
<br>> lib/vhost/virtio_net.c | 6 +++---
<br>> 1 file changed, 3 insertions(+), 3 deletions(-)
<br>>
<br>> diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c
<br>> index 68a26eb17d..eb254e1024 100644
<br>> --- a/lib/vhost/virtio_net.c
<br>> +++ b/lib/vhost/virtio_net.c
<br>> @@ -2850,11 +2850,11 @@ virtio_dev_tx_split(struct virtio_net *dev, struct
<br>> vhost_virtqueue *vq,
<br>> if (dropped)
<br>> rte_pktmbuf_free_bulk(&pkts[i - 1], count - i + 1);
<br>>
<br>> - vq->last_avail_idx += i;
<br>> + vq->last_avail_idx += i - dropped;
<br>>
<br>> do_data_copy_dequeue(vq);
<br>> - if (unlikely(i < count))
<br>> - vq->shadow_used_idx = i;
<br>> + if (unlikely((i - dropped) < count))
<br>> + vq->shadow_used_idx = i - dropped;
<br>> if (likely(vq->shadow_used_idx)) {
<br>> flush_shadow_used_ring_split(dev, vq);
<br>> vhost_vring_call_split(dev, vq);
<br>> --
<br>> 2.32.0
<br></div></div>
</div>