[DPDK/ethdev Bug 1416] net/af_packet: tx_burst() can modify packets

[Morten Brørup]

+TO: John W. Linville, AF_PACKET maintainer

> > > > > > > static uint16_t
> > > > > > > eth_af_packet_tx(void *queue, struct rte_mbuf **bufs,
> uint16_t
> > > > > nb_pkts)
> > > > > > > {
> > > > > > >         ...
> > > > > > >         for (i = 0; i < nb_pkts; i++) {
> > > > > > >                 mbuf = *bufs++;
> > > > > > >
> > > > > > >                 ...
> > > > > > >
> > > > > > >                 /* insert vlan info if necessary */
> > > > > > >                 if (mbuf->ol_flags & RTE_MBUF_F_TX_VLAN) {
> > > > > > >                         if (rte_vlan_insert(&mbuf)) {
> > > > > > >                                 rte_pktmbuf_free(mbuf);
> > > > > > >                                 continue;
> > > > > > >
> > > > > > > AFAIU, it does copy of mbuf contents into pbuf anyway (just
> few
> > > line
> > > > > below).
> > > > > > > So the fix might be - simply insert VLAN tag at copying
> stage.
> > > > > > > Feel free to correct me, if I missed something.
> > > > > >
> > > > > > vlan_insert will fail if the mbuf is has refcnt > 1.
> > > > > >
> > > > > > static inline int rte_vlan_insert(struct rte_mbuf **m)
> > > > > > {
> > > > > > 	struct rte_ether_hdr *oh, *nh;
> > > > > > 	struct rte_vlan_hdr *vh;
> > > > > >
> > > > > > 	/* Can't insert header if mbuf is shared */
> > > > > > 	if (!RTE_MBUF_DIRECT(*m) || rte_mbuf_refcnt_read(*m) > 1)
> > > > > > 		return -EINVAL;
> > > > >
> > > > > You are right, I missed that.
> > > > > Will close it then.
> > > >
> > > > Don't close, silent drop is also a bug.
> > > >
> > > > The VLAN tag could be insert when copying, as originally
> suggested.
> > >
> > > Agree, but to me that would be enhancement request, not a bug
> report.
> >
> > Hmm... there is still a bug, although slightly different:
> >
> > net/af_packet: tx_burst() silently drops packets with
> RTE_MBUF_F_TX_VLAN if mbuf is shared

I took a more thorough look at the code.
I was wrong: The drop is not silent, the err_pkts counter is incremented.
But still a bug (non-conformance) to claim VLAN Insert capability, and not fully support it.

> >
> > And the suggested fixes would fix this (other) bug.

The kernel doesn't look at TP_STATUS_VLAN_VALID in TX direction, so setting the VLAN tag in the tpacket2_hdr doesn't work; inserting it in the data when copying would be the fix.

Before the copy loop, the first segment should be copied, possibly with VLAN insertion.
And the copy loop should copy the following segments (if any), i.e. starting at *tmp_mbuf = mbuf->next.

As a separate bug, the check for oversize packets doesn't consider the length of an inserted VLAN tag, and could cause a buffer overrun if the packet is large enough.
However, with a default buffer size of 2048, this is very unlikely in reality.

> 
> 
> In older DPDK, vlan_insert would try and clone the mbuf, but doing a
> rte_pktmbuf_clone().
> But that was buggy and removed by:
> 
> commit 15a74163b12ed9b8b980b1576bdd8de16d60612b
> Author: Ferruh Yigit <ferruh.yigit at intel.com>
> Date:   Tue Apr 16 16:51:26 2019 +0100
> 
>     net: forbid VLAN insert in shared mbuf
> 
>     The vlan_insert() is buggy when it tries to handle the shared mbufs,
>     instead don't support inserting VLAN tag into shared mbufs and
> return
>     an error for that case.
> 
>     Signed-off-by: Ferruh Yigit <ferruh.yigit at intel.com>
>     Acked-by: Olivier Matz <olivier.matz at 6wind.com>
> 
>