search for: hdr_p

..._to_skb(struct virtnet_info *vi, struct receive_queue *rq, struct page *page, unsigned int offset, unsigned int len, unsigned int truesize, unsigned int headroom) { [...] struct virtio_net_hdr_mrg_rxbuf *hdr; [...] hdr_len = vi->hdr_len; [...] ok: hdr = skb_vnet_hdr(skb); memcpy(hdr, hdr_p, hdr_len); [...] } When VIRTIO_NET_F_HASH_REPORT feature is enabled, hdr_len = 20 But the sizeof(*hdr) is 12, memcpy(hdr, hdr_p, hdr_len); will copy 20 bytes to the hdr, which make a potential risk of bug. And this risk can be avoided by introducing struct skb_vnet_common_hdr. Change log v1->v...

..._to_skb(struct virtnet_info *vi, struct receive_queue *rq, struct page *page, unsigned int offset, unsigned int len, unsigned int truesize, unsigned int headroom) { [...] struct virtio_net_hdr_mrg_rxbuf *hdr; [...] hdr_len = vi->hdr_len; [...] ok: hdr = skb_vnet_hdr(skb); memcpy(hdr, hdr_p, hdr_len); [...] } When VIRTIO_NET_F_HASH_REPORT feature is enabled, hdr_len = 20 But the sizeof(*hdr) is 12, memcpy(hdr, hdr_p, hdr_len); will copy 20 bytes to the hdr, which make a potential risk of bug. And this risk can be avoided by introducing struct virtio_net_hdr_mrg_rxbuf. Change log v1-...

...unsigned int len, unsigned int truesize, > unsigned int headroom) > { > [...] > struct virtio_net_hdr_mrg_rxbuf *hdr; > [...] > hdr_len = vi->hdr_len; > [...] > ok: > hdr = skb_vnet_hdr(skb); > memcpy(hdr, hdr_p, hdr_len); > [...] > } > > When VIRTIO_NET_F_HASH_REPORT feature is enabled, hdr_len = 20 > But the sizeof(*hdr) is 12, > memcpy(hdr, hdr_p, hdr_len); will copy 20 bytes to the hdr, > which make a potential risk of bug. And this risk can be avoided by > introducing struct vi...

...ruesize, >> unsigned int headroom) >> { >> [...] >> struct virtio_net_hdr_mrg_rxbuf *hdr; >> [...] >> hdr_len = vi->hdr_len; >> [...] >> ok: >> hdr = skb_vnet_hdr(skb); >> memcpy(hdr, hdr_p, hdr_len); >> [...] >> } >> >> When VIRTIO_NET_F_HASH_REPORT feature is enabled, hdr_len = 20 >> But the sizeof(*hdr) is 12, >> memcpy(hdr, hdr_p, hdr_len); will copy 20 bytes to the hdr, >> which make a potential risk of bug. And this risk can be avoided b...

...gt; > [...] > > > > struct virtio_net_hdr_mrg_rxbuf *hdr; > > > > [...] > > > > hdr_len = vi->hdr_len; > > > > [...] > > > > ok: > > > > hdr = skb_vnet_hdr(skb); > > > > memcpy(hdr, hdr_p, hdr_len); > > > > [...] > > > > } > > > > > > > > When VIRTIO_NET_F_HASH_REPORT feature is enabled, hdr_len = 20 > > > > But the sizeof(*hdr) is 12, > > > > memcpy(hdr, hdr_p, hdr_len); will copy 20 bytes to the hdr, > >...

...gt; > [...] > > > > struct virtio_net_hdr_mrg_rxbuf *hdr; > > > > [...] > > > > hdr_len = vi->hdr_len; > > > > [...] > > > > ok: > > > > hdr = skb_vnet_hdr(skb); > > > > memcpy(hdr, hdr_p, hdr_len); > > > > [...] > > > > } > > > > > > > > When VIRTIO_NET_F_HASH_REPORT feature is enabled, hdr_len = 20 > > > > But the sizeof(*hdr) is 12, > > > > memcpy(hdr, hdr_p, hdr_len); will copy 20 bytes to the hdr, > >...

...nt headroom) > >> { > >> [...] > >> struct virtio_net_hdr_mrg_rxbuf *hdr; > >> [...] > >> hdr_len = vi->hdr_len; > >> [...] > >> ok: > >> hdr = skb_vnet_hdr(skb); > >> memcpy(hdr, hdr_p, hdr_len); > >> [...] > >> } > >> > >> When VIRTIO_NET_F_HASH_REPORT feature is enabled, hdr_len = 20 > >> But the sizeof(*hdr) is 12, > >> memcpy(hdr, hdr_p, hdr_len); will copy 20 bytes to the hdr, > >> which make a potential risk of...

...t_max_descs; + + /* Do we have virtqueues with small vrings? */ + bool svring; + /* CPU hotplug instances for online & dead */ struct hlist_node node; struct hlist_node node_dead; @@ -455,6 +463,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi, unsigned int copy, hdr_len, hdr_padded_len; struct page *page_to_free = NULL; int tailroom, shinfo_size; + u16 max_frags = MAX_SKB_FRAGS; char *p, *hdr_p, *buf; p = page_address(page) + offset; @@ -520,7 +529,10 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi, * tries to receive more than is possible. Thi...

...small"? all of them? some rx rings? some tx rings? names should make it clear. also do we really need bool svring? can't we just check single_pkt_max_descs all the time? > @@ -455,6 +463,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi, > unsigned int copy, hdr_len, hdr_padded_len; > struct page *page_to_free = NULL; > int tailroom, shinfo_size; > + u16 max_frags = MAX_SKB_FRAGS; > char *p, *hdr_p, *buf; > > p = page_address(page) + offset; > @@ -520,7 +529,10 @@ static struct sk_buff *page_to_skb(struct virtnet_info *vi, > * tri...

At the moment, if a virtio network device uses vrings with less than MAX_SKB_FRAGS + 2 entries, the device won't be functional. The following condition vq->num_free >= 2 + MAX_SKB_FRAGS will always evaluate to false, leading to TX timeouts. This patchset attempts this fix this bug, and to allow small rings down to 4 entries. The first patch introduces a new mechanism in virtio core -