When copy_desc_to_mbuf function failed, i added 1. And last_avail_idx added i, other than i - 1. It may cause that the first mbuf in mbuf-list is dropped, the second mbuf in mbuf-list is received in the following rx procedure. And The pkt_len of the second mbuf is zero, resulting in segment fault when parsing the mbuf.
Fixes: 0fd5608ef97f ("vhost: handle mbuf allocation failure") Cc: sta...@dpdk.org Signed-off-by: Gaoxiang Liu <liugaoxi...@huawei.com> --- lib/vhost/virtio_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/vhost/virtio_net.c b/lib/vhost/virtio_net.c index 68a26eb17d..86f1c04b43 100644 --- a/lib/vhost/virtio_net.c +++ b/lib/vhost/virtio_net.c @@ -2850,7 +2850,7 @@ virtio_dev_tx_split(struct virtio_net *dev, struct vhost_virtqueue *vq, if (dropped) rte_pktmbuf_free_bulk(&pkts[i - 1], count - i + 1); - vq->last_avail_idx += i; + vq->last_avail_idx += i - 1; do_data_copy_dequeue(vq); if (unlikely(i < count)) -- 2.32.0