[PATCH] net/vhost: preserve Tx ownership on VLAN failure

[Maxime Coquelin]

On Sun, Jul 26, 2026 at 7:03 PM Weijun Pan <wpan3636 at gmail.com> wrote:
>
> The Tx path compacts the input mbuf array after software VLAN
> insertion fails. Later packets are moved into the failed packet's
> slot while the failed mbuf is freed.
>
> The returned count then no longer identifies a prefix of the original
> burst. An application freeing the unsent suffix can therefore free
> duplicate or stale mbuf pointers.
>
> Stop preprocessing at the first VLAN insertion failure and leave the
> failed mbuf and the remaining suffix owned by the caller. Count only
> packets prepared for vhost enqueue but not accepted as missed.
>
> Bugzilla ID: 1884
> Fixes: f63d356ee993 ("net/vhost: insert/strip VLAN header in software")
> Cc: stable at dpdk.org
>
> Signed-off-by: Weijun Pan <wpan3636 at gmail.com>
> ---
> Cc: Jan Blunck <jblunck at infradead.org>
>
> Tested:
> - Full x86_64 debug build with AddressSanitizer.
> - Two-process net_vhost and virtio-user data-path test.
> - Forced VLAN insertion failure on packet 1 by removing its headroom.
> - rte_eth_tx_burst() returned 1 and preserved the unsent suffix.
> - testpmd received 1 packet with no RX errors or missed packets.
>
>  drivers/net/vhost/rte_eth_vhost.c | 14 ++++++--------
>  1 file changed, 6 insertions(+), 8 deletions(-)
>
Reviewed-by: Maxime Coquelin <maxime.coquelin at redhat.com>

Thanks,
Maxime