similar to: [PATCH net] vhost_net: do not report a used len larger than receive buffer size

commit 8b38694a2dc8b18374310df50174f1e4376d6824 vhost/net: virtio 1.0 byte swap had this chunk: - heads[headcount - 1].len += datalen; + heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen); This adds datalen with the wrong sign, causing guest panics. Fixes: 8b38694a2dc8b18374310df50174f1e4376d6824 Reported-by: Alex Williamson <alex.williamson at redhat.com>

commit 8b38694a2dc8b18374310df50174f1e4376d6824 vhost/net: virtio 1.0 byte swap had this chunk: - heads[headcount - 1].len += datalen; + heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen); This adds datalen with the wrong sign, causing guest panics. Fixes: 8b38694a2dc8b18374310df50174f1e4376d6824 Reported-by: Alex Williamson <alex.williamson at redhat.com>

This patch adds mergeable receive buffer support to vhost_net. Signed-off-by: David L Stevens <dlstevens at us.ibm.com> diff -ruNp net-next-v0/drivers/vhost/net.c net-next-v7/drivers/vhost/net.c --- net-next-v0/drivers/vhost/net.c 2010-04-24 21:36:54.000000000 -0700 +++ net-next-v7/drivers/vhost/net.c 2010-04-28 12:26:18.000000000 -0700 @@ -74,6 +74,23 @@ static int move_iovec_hdr(struct

This patch adds mergeable receive buffer support to vhost_net. Signed-off-by: David L Stevens <dlstevens at us.ibm.com> diff -ruNp net-next-v0/drivers/vhost/net.c net-next-v7/drivers/vhost/net.c --- net-next-v0/drivers/vhost/net.c 2010-04-24 21:36:54.000000000 -0700 +++ net-next-v7/drivers/vhost/net.c 2010-04-28 12:26:18.000000000 -0700 @@ -74,6 +74,23 @@ static int move_iovec_hdr(struct

On 2020/6/2 ??9:06, Michael S. Tsirkin wrote: > Convert vhost net to use the new format-agnostic API. > In particular, don't poke at vq internals such as the > heads array. > > Signed-off-by: Michael S. Tsirkin <mst at redhat.com> > --- > drivers/vhost/net.c | 153 +++++++++++++++++++++++--------------------- > 1 file changed, 81 insertions(+), 72 deletions(-)

When mergeable buffers are disabled, and the incoming packet is too large for the rx buffer, get_rx_bufs returns success. This was intentional in order for make recvmsg truncate the packet and then handle_rx would detect err != sock_len and drop it. Unfortunately we pass the original sock_len to recvmsg - which means we use parts of iov not fully validated. Fix this up by detecting this overrun

When mergeable buffers are disabled, and the incoming packet is too large for the rx buffer, get_rx_bufs returns success. This was intentional in order for make recvmsg truncate the packet and then handle_rx would detect err != sock_len and drop it. Unfortunately we pass the original sock_len to recvmsg - which means we use parts of iov not fully validated. Fix this up by detecting this overrun

When vhost support VIRTIO_VSOCK_F_MRG_RXBUF feature, it will merge big packet into rx vq. Signed-off-by: Yiwen Jiang <jiangyiwen at huawei.com> --- drivers/vhost/vsock.c | 117 +++++++++++++++++++++++++++++++------- include/linux/virtio_vsock.h | 1 + include/uapi/linux/virtio_vsock.h | 5 ++ 3 files changed, 102 insertions(+), 21 deletions(-) diff --git

When vhost support VIRTIO_VSOCK_F_MRG_RXBUF feature, it will merge big packet into rx vq. Signed-off-by: Yiwen Jiang <jiangyiwen at huawei.com> --- drivers/vhost/vsock.c | 117 +++++++++++++++++++++++++++++++------- include/linux/virtio_vsock.h | 1 + include/uapi/linux/virtio_vsock.h | 5 ++ 3 files changed, 102 insertions(+), 21 deletions(-) diff --git

When vhost support VIRTIO_VSOCK_F_MRG_RXBUF feature, it will merge big packet into rx vq. Signed-off-by: Yiwen Jiang <jiangyiwen at huawei.com> --- drivers/vhost/vsock.c | 111 ++++++++++++++++++++++++++++++-------- include/linux/virtio_vsock.h | 1 + include/uapi/linux/virtio_vsock.h | 5 ++ 3 files changed, 94 insertions(+), 23 deletions(-) diff --git

When vhost support VIRTIO_VSOCK_F_MRG_RXBUF feature, it will merge big packet into rx vq. Signed-off-by: Yiwen Jiang <jiangyiwen at huawei.com> --- drivers/vhost/vsock.c | 111 ++++++++++++++++++++++++++++++-------- include/linux/virtio_vsock.h | 1 + include/uapi/linux/virtio_vsock.h | 5 ++ 3 files changed, 94 insertions(+), 23 deletions(-) diff --git

len is always initialized since function is called with size > 0. Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- drivers/vhost/net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index 984242e..54ffbb0 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -501,7 +501,7 @@ static int get_rx_bufs(struct

len is always initialized since function is called with size > 0. Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- drivers/vhost/net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index 984242e..54ffbb0 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -501,7 +501,7 @@ static int get_rx_bufs(struct

This patch adds support for the Mergeable Receive Buffers feature to vhost_net. +-DLS Changes from previous revision: 1) renamed: vhost_discard_vq_desc -> vhost_discard_desc vhost_get_heads -> vhost_get_desc_n vhost_get_vq_desc -> vhost_get_desc 2) added heads as argument to ghost_get_desc_n 3) changed "vq->heads" from iovec to vring_used_elem, removed casts 4)

This patch adds support for the Mergeable Receive Buffers feature to vhost_net. +-DLS Changes from previous revision: 1) renamed: vhost_discard_vq_desc -> vhost_discard_desc vhost_get_heads -> vhost_get_desc_n vhost_get_vq_desc -> vhost_get_desc 2) added heads as argument to ghost_get_desc_n 3) changed "vq->heads" from iovec to vring_used_elem, removed casts 4)

On 2018/12/12 23:37, Michael S. Tsirkin wrote: > On Wed, Dec 12, 2018 at 05:29:31PM +0800, jiangyiwen wrote: >> When vhost support VIRTIO_VSOCK_F_MRG_RXBUF feature, >> it will merge big packet into rx vq. >> >> Signed-off-by: Yiwen Jiang <jiangyiwen at huawei.com> > > I feel this approach jumps into making interface changes for > optimizations too

On 2018/12/12 23:37, Michael S. Tsirkin wrote: > On Wed, Dec 12, 2018 at 05:29:31PM +0800, jiangyiwen wrote: >> When vhost support VIRTIO_VSOCK_F_MRG_RXBUF feature, >> it will merge big packet into rx vq. >> >> Signed-off-by: Yiwen Jiang <jiangyiwen at huawei.com> > > I feel this approach jumps into making interface changes for > optimizations too

I had to add an explicit tag to suppress compiler warning: gcc isn't smart enough to notice that len is always initialized since function is called with size > 0. Signed-off-by: Michael S. Tsirkin <mst at redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck at de.ibm.com> --- drivers/vhost/net.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff

I had to add an explicit tag to suppress compiler warning: gcc isn't smart enough to notice that len is always initialized since function is called with size > 0. Signed-off-by: Michael S. Tsirkin <mst at redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck at de.ibm.com> --- drivers/vhost/net.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff

On Mon, Dec 01, 2014 at 01:37:40PM +0100, Cornelia Huck wrote: > On Sun, 30 Nov 2014 17:12:13 +0200 > "Michael S. Tsirkin" <mst at redhat.com> wrote: > > > len is always initialized since function is called with size > 0. > > > > Signed-off-by: Michael S. Tsirkin <mst at redhat.com> > > --- > > drivers/vhost/net.c | 2 +- > >