search for: headcount

....com/netdev at vger.kernel.org/msg187936.html Eventually we figured out that it was a skb leak in handle_rx() when sending packets to the VM. This usually happens when a guest can not drain out vq as fast as vhost fills in, afterwards it sets off the traffic jam and leaks skb(s) which occurs as no headcount to send on the vq from vhost side. This can be avoided by making sure we have got enough headcount before actually consuming a skb from the batched rx array while transmitting, which is simply done by moving checking the zero headcount a bit ahead. Also strengthen the small possibility of leak in...

....com/netdev at vger.kernel.org/msg187936.html Eventually we figured out that it was a skb leak in handle_rx() when sending packets to the VM. This usually happens when a guest can not drain out vq as fast as vhost fills in, afterwards it sets off the traffic jam and leaks skb(s) which occurs as no headcount to send on the vq from vhost side. This can be avoided by making sure we have got enough headcount before actually consuming a skb from the batched rx array while transmitting, which is simply done by moving checking the zero headcount a bit ahead. Also strengthen the small possibility of leak in...

...e system. */ @@ -80,6 +81,68 @@ static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) return vsock; } +static int get_rx_bufs(struct vhost_virtqueue *vq, + struct vring_used_elem *heads, int datalen, + unsigned *iovcount, unsigned int quota) +{ + unsigned int out, in; + int seg = 0; + int headcount = 0; + unsigned d; + int ret; + /* + * len is always initialized before use since we are always called with + * datalen > 0. + */ + u32 uninitialized_var(len); + + while (datalen > 0 && headcount < quota) { + if (unlikely(seg >= UIO_MAXIOV)) { + ret = -ENOBUFS; + goto er...

...e system. */ @@ -80,6 +81,68 @@ static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) return vsock; } +static int get_rx_bufs(struct vhost_virtqueue *vq, + struct vring_used_elem *heads, int datalen, + unsigned *iovcount, unsigned int quota) +{ + unsigned int out, in; + int seg = 0; + int headcount = 0; + unsigned d; + int ret; + /* + * len is always initialized before use since we are always called with + * datalen > 0. + */ + u32 uninitialized_var(len); + + while (datalen > 0 && headcount < quota) { + if (unlikely(seg >= UIO_MAXIOV)) { + ret = -ENOBUFS; + goto er...

...This is a multi-buffer version of vhost_get_desc, that works if - * vq has read descriptors only. - * @vq - the relevant virtqueue - * @datalen - data length we'll be reading - * @iovcount - returned count of io vectors we fill - * @log - vhost log - * @log_num - log offset - * @quota - headcount quota, 1 for big buffer - * returns number of buffer heads allocated, negative on error - */ -static int get_rx_bufs(struct vhost_virtqueue *vq, - struct vring_used_elem *heads, - int datalen, - unsigned *iovcount, - struct vhost_log *log, - unsigned *log_num...

...host_get_desc, that works if > - * vq has read descriptors only. > - * @vq - the relevant virtqueue > - * @datalen - data length we'll be reading > - * @iovcount - returned count of io vectors we fill > - * @log - vhost log > - * @log_num - log offset > - * @quota - headcount quota, 1 for big buffer > - * returns number of buffer heads allocated, negative on error > - */ > -static int get_rx_bufs(struct vhost_virtqueue *vq, > - struct vring_used_elem *heads, > - int datalen, > - unsigned *iovcount, > - struct vhost_lo...

...vsock_get(u32 guest_cid) return vsock; } +/* This segment of codes are copied from drivers/vhost/net.c */ +static int get_rx_bufs(struct vhost_virtqueue *vq, + struct vring_used_elem *heads, int datalen, + unsigned *iovcount, unsigned int quota) +{ + unsigned int out, in; + int seg = 0; + int headcount = 0; + unsigned d; + int ret; + /* + * len is always initialized before use since we are always called with + * datalen > 0. + */ + u32 uninitialized_var(len); + + while (datalen > 0 && headcount < quota) { + if (unlikely(seg >= UIO_MAXIOV)) { + ret = -ENOBUFS; + goto er...

...vsock_get(u32 guest_cid) return vsock; } +/* This segment of codes are copied from drivers/vhost/net.c */ +static int get_rx_bufs(struct vhost_virtqueue *vq, + struct vring_used_elem *heads, int datalen, + unsigned *iovcount, unsigned int quota) +{ + unsigned int out, in; + int seg = 0; + int headcount = 0; + unsigned d; + int ret; + /* + * len is always initialized before use since we are always called with + * datalen > 0. + */ + u32 uninitialized_var(len); + + while (datalen > 0 && headcount < quota) { + if (unlikely(seg >= UIO_MAXIOV)) { + ret = -ENOBUFS; + goto er...

...msg_flags = MSG_DONTWAIT, }; - struct virtio_net_hdr hdr = { - .flags = 0, - .gso_type = VIRTIO_NET_HDR_GSO_NONE + struct virtio_net_hdr_mrg_rxbuf hdr = { + .hdr.flags = 0, + .hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE }; size_t len, total_len = 0; - int err; - size_t hdr_size; + int err, headcount, datalen; + size_t vhost_hlen; struct socket *sock = rcu_dereference(vq->private_data); if (!sock || skb_queue_empty(&sock->sk->sk_receive_queue)) return; @@ -218,18 +248,19 @@ static void handle_rx(struct vhost_net * use_mm(net->dev.mm); mutex_lock(&vq->mutex);...

...msg_flags = MSG_DONTWAIT, }; - struct virtio_net_hdr hdr = { - .flags = 0, - .gso_type = VIRTIO_NET_HDR_GSO_NONE + struct virtio_net_hdr_mrg_rxbuf hdr = { + .hdr.flags = 0, + .hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE }; size_t len, total_len = 0; - int err; - size_t hdr_size; + int err, headcount, datalen; + size_t vhost_hlen; struct socket *sock = rcu_dereference(vq->private_data); if (!sock || skb_queue_empty(&sock->sk->sk_receive_queue)) return; @@ -218,18 +248,19 @@ static void handle_rx(struct vhost_net * use_mm(net->dev.mm); mutex_lock(&vq->mutex);...

...This is a multi-buffer version of vhost_get_desc, that works if - * vq has read descriptors only. - * @vq - the relevant virtqueue - * @datalen - data length we'll be reading - * @iovcount - returned count of io vectors we fill - * @log - vhost log - * @log_num - log offset - * @quota - headcount quota, 1 for big buffer - * returns number of buffer heads allocated, negative on error - */ -static int get_rx_bufs(struct vhost_virtqueue *vq, - struct vring_used_elem *heads, - int datalen, - unsigned *iovcount, - struct vhost_log *log, - unsigned *log_num...

commit 8b38694a2dc8b18374310df50174f1e4376d6824 vhost/net: virtio 1.0 byte swap had this chunk: - heads[headcount - 1].len += datalen; + heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen); This adds datalen with the wrong sign, causing guest panics. Fixes: 8b38694a2dc8b18374310df50174f1e4376d6824 Reported-by: Alex Williamson <alex.williamson at redhat.com> Suggested-by: Greg Kurz <gk...

commit 8b38694a2dc8b18374310df50174f1e4376d6824 vhost/net: virtio 1.0 byte swap had this chunk: - heads[headcount - 1].len += datalen; + heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen); This adds datalen with the wrong sign, causing guest panics. Fixes: 8b38694a2dc8b18374310df50174f1e4376d6824 Reported-by: Alex Williamson <alex.williamson at redhat.com> Suggested-by: Greg Kurz <gk...

...f codes are copied from drivers/vhost/net.c */ >> +static int get_rx_bufs(struct vhost_virtqueue *vq, >> + struct vring_used_elem *heads, int datalen, >> + unsigned *iovcount, unsigned int quota) >> +{ >> + unsigned int out, in; >> + int seg = 0; >> + int headcount = 0; >> + unsigned d; >> + int ret; >> + /* >> + * len is always initialized before use since we are always called with >> + * datalen > 0. >> + */ >> + u32 uninitialized_var(len); >> + >> + while (datalen > 0 && headcount <...

...f codes are copied from drivers/vhost/net.c */ >> +static int get_rx_bufs(struct vhost_virtqueue *vq, >> + struct vring_used_elem *heads, int datalen, >> + unsigned *iovcount, unsigned int quota) >> +{ >> + unsigned int out, in; >> + int seg = 0; >> + int headcount = 0; >> + unsigned d; >> + int ret; >> + /* >> + * len is always initialized before use since we are always called with >> + * datalen > 0. >> + */ >> + u32 uninitialized_var(len); >> + >> + while (datalen > 0 && headcount <...

...et.c +++ b/drivers/vhost/net.c @@ -361,13 +361,21 @@ static void handle_rx(struct vhost_net *net) break; } /* TODO: Should check and handle checksum. */ - if (vhost_has_feature(&net->dev, VIRTIO_NET_F_MRG_RXBUF) && - memcpy_toiovecend(vq->hdr, (unsigned char *)&headcount, - offsetof(typeof(hdr), num_buffers), - sizeof hdr.num_buffers)) { - vq_err(vq, "Failed num_buffers write"); + if (vhost_has_feature(&net->dev, VIRTIO_NET_F_MRG_RXBUF)) { + if (memcpy_toiovecend(vq->hdr, + (unsigned char *)&headcount, +...

...et.c +++ b/drivers/vhost/net.c @@ -361,13 +361,21 @@ static void handle_rx(struct vhost_net *net) break; } /* TODO: Should check and handle checksum. */ - if (vhost_has_feature(&net->dev, VIRTIO_NET_F_MRG_RXBUF) && - memcpy_toiovecend(vq->hdr, (unsigned char *)&headcount, - offsetof(typeof(hdr), num_buffers), - sizeof hdr.num_buffers)) { - vq_err(vq, "Failed num_buffers write"); + if (vhost_has_feature(&net->dev, VIRTIO_NET_F_MRG_RXBUF)) { + if (memcpy_toiovecend(vq->hdr, + (unsigned char *)&headcount, +...

....com/netdev at vger.kernel.org/msg187936.html Eventually we figured out that it was a skb leak in handle_rx() when sending packets to the VM. This usually happens when a guest can not drain out vq as fast as vhost fills in, afterwards it sets off the traffic jam and leaks skb(s) which occurs as no headcount to send on the vq from vhost side. This can be avoided by making sure we have got enough headcount before actually consuming a skb from the batched rx array while transmitting, which is simply done by deferring it a moment later in this patch. Signed-off-by: Wei Xu <wexu at redhat.com> ---...

....com/netdev at vger.kernel.org/msg187936.html Eventually we figured out that it was a skb leak in handle_rx() when sending packets to the VM. This usually happens when a guest can not drain out vq as fast as vhost fills in, afterwards it sets off the traffic jam and leaks skb(s) which occurs as no headcount to send on the vq from vhost side. This can be avoided by making sure we have got enough headcount before actually consuming a skb from the batched rx array while transmitting, which is simply done by deferring it a moment later in this patch. Signed-off-by: Wei Xu <wexu at redhat.com> ---...

...l >> >> Eventually we figured out that it was a skb leak in handle_rx() >> when sending packets to the VM. This usually happens when a guest >> can not drain out vq as fast as vhost fills in, afterwards it sets >> off the traffic jam and leaks skb(s) which occurs as no headcount >> to send on the vq from vhost side. >> >> This can be avoided by making sure we have got enough headcount >> before actually consuming a skb from the batched rx array while >> transmitting, which is simply done by moving checking the zero >> headcount a bit ahe...