> -----Original Message----- > From: Jiang, Cheng1 <cheng1.ji...@intel.com> > Sent: Thursday, July 15, 2021 5:51 PM > To: maxime.coque...@redhat.com; Xia, Chenbo <chenbo....@intel.com> > Cc: dev@dpdk.org; Hu, Jiayu <jiayu...@intel.com>; Yang, YvonneX > <yvonnex.y...@intel.com>; Jiang, Cheng1 <cheng1.ji...@intel.com>; > sta...@dpdk.org > Subject: [PATCH v2] vhost: fix index overflow for packed ring in async vhost > > We introduced some new indexes in packed ring of async vhost. They > will eventually overflow and lead to errors if the ring size is not > a power of 2. This patch is to check and keep these indexes within a > reasonable range. > > Fixes: 873e8dad6f49 ("vhost: support packed ring in async datapath") > Cc: sta...@dpdk.org > > Signed-off-by: Cheng Jiang <cheng1.ji...@intel.com> > --- > lib/vhost/virtio_net.c | 21 ++++++++++++++------- > 1 file changed, 14 insertions(+), 7 deletions(-) > > diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c > index f4a2c88d8b..bfb2bf8fc4 100644 > --- a/lib/vhost/virtio_net.c > +++ b/lib/vhost/virtio_net.c > @@ -2036,7 +2036,7 @@ virtio_dev_rx_async_submit_packed(struct virtio_net > *dev, > > slot_idx = (vq->async_pkts_idx + num_async_pkts) % vq->size; > if (it_pool[it_idx].count) { > - uint16_t from, to; > + uint16_t from; > > async_descs_idx += num_descs; > async_fill_desc(&tdes[pkt_burst_idx++], > @@ -2055,11 +2055,13 @@ virtio_dev_rx_async_submit_packed(struct virtio_net > *dev, > * descriptors. > */ > from = vq->shadow_used_idx - num_buffers; > - to = vq->async_buffer_idx_packed % vq->size; > store_dma_desc_info_packed(vq->shadow_used_packed, > - vq->async_buffers_packed, vq->size, > from, to, > num_buffers); > + vq->async_buffers_packed, vq->size, > from, > + vq->async_buffer_idx_packed, > num_buffers); > > vq->async_buffer_idx_packed += num_buffers; > + if (vq->async_buffer_idx_packed >= vq->size) > + vq->async_buffer_idx_packed -= vq->size; > vq->shadow_used_idx -= num_buffers; > } else { > comp_pkts[num_done_pkts++] = pkts[pkt_idx]; > @@ -2112,6 +2114,8 @@ virtio_dev_rx_async_submit_packed(struct virtio_net > *dev, > dma_error_handler_packed(vq, async_descs, async_descs_idx, > slot_idx, pkt_err, > &pkt_idx, &num_async_pkts, > &num_done_pkts); > vq->async_pkts_idx += num_async_pkts; > + if (vq->async_pkts_idx >= vq->size) > + vq->async_pkts_idx -= vq->size; > *comp_count = num_done_pkts; > > if (likely(vq->shadow_used_idx)) { > @@ -2160,7 +2164,7 @@ write_back_completed_descs_packed(struct vhost_virtqueue > *vq, > uint16_t from, to; > > do { > - from = vq->last_async_buffer_idx_packed % vq->size; > + from = vq->last_async_buffer_idx_packed; > to = (from + nr_left) % vq->size; > if (to > from) { > vhost_update_used_packed(vq, vq->async_buffers_packed + > from, > to - from); > @@ -2169,7 +2173,7 @@ write_back_completed_descs_packed(struct vhost_virtqueue > *vq, > } else { > vhost_update_used_packed(vq, vq->async_buffers_packed + > from, > vq->size - from); > - vq->last_async_buffer_idx_packed += vq->size - from; > + vq->last_async_buffer_idx_packed = 0; > nr_left -= vq->size - from; > } > } while (nr_left > 0); > @@ -2252,10 +2256,13 @@ uint16_t rte_vhost_poll_enqueue_completed(int vid, > uint16_t queue_id, > vhost_vring_call_split(dev, vq); > } > } else { > - if (vq_is_packed(dev)) > + if (vq_is_packed(dev)) { > vq->last_async_buffer_idx_packed += n_buffers; > - else > + if (vq->last_async_buffer_idx_packed >= vq->size) > + vq->last_async_buffer_idx_packed -= vq->size; > + } else { > vq->last_async_desc_idx_split += n_descs; > + } > } > > done: > -- > 2.29.2
Reviewed-by: Chenbo Xia <chenbo....@intel.com>