Skip to contentSkip to conversation

vhost: fix buffer length calculation

PATCH Applied Tiwei Bie 4 participants 5 messages Jul 17, 2018 – Jul 19, 2018 1 message not in the archive

lore
Share & tools
lore

Tiwei Bie

author
#0 lore raw

PATCH 1/1 vhost: fix buffer length calculation

Fixes fd68b4739d2c ("vhost: use buffer vectors in dequeue path")
Reported-by Yinan Wang <[email protected]>
Signed-off-by Tiwei Bie <[email protected]>
---
 lib/librte_vhost/virtio_net.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
lib/librte_vhost/virtio_net.c +5 -3
index 2b7ffcf92..07cc0c845 100644
@@ -720,7 +720,8 @@ copy_mbuf_to_desc(struct virtio_net *dev, struct vhost_virtqueue *vq,
 				uint16_t hdr_vec_idx = 0;
 
 				while (remain) {
-					len = remain;
+					len = RTE_MIN(remain,
+						buf_vec[hdr_vec_idx].buf_len);
 					dst = buf_vec[hdr_vec_idx].buf_addr;
 					rte_memcpy((void *)(uintptr_t)dst,
 							(void *)(uintptr_t)src,

@@ -747,7 +748,7 @@ copy_mbuf_to_desc(struct virtio_net *dev, struct vhost_virtqueue *vq,
 			hdr_addr = 0;
 		}
 
-		cpy_len = RTE_MIN(buf_len, mbuf_avail);
+		cpy_len = RTE_MIN(buf_avail, mbuf_avail);
 
 		if (likely(cpy_len > MAX_BATCH_LEN ||
 					vq->batch_copy_nb_elems >= vq->size)) {

@@ -1112,7 +1113,8 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vhost_virtqueue *vq,
 			 * in a contiguous virtual area.
 			 */
 			while (remain) {
-				len = remain;
+				len = RTE_MIN(remain,
+					buf_vec[hdr_vec_idx].buf_len);
 				src = buf_vec[hdr_vec_idx].buf_addr;
 				rte_memcpy((void *)(uintptr_t)dst,
 						   (void *)(uintptr_t)src, len);
Signature · 1 line
2.18.0
Acked-by on v1 1/1
#1 lore raw
Quoted 55 lines

-----Original Message-----
From: Bie, Tiwei
Sent: Tuesday, July 17, 2018 9:11 PM
To: [email protected]; Wang, Zhihong <[email protected]>; [email protected]
Cc: Wang, Yinan <[email protected]>; Yao, Lei A <[email protected]>
Subject: [PATCH] vhost: fix buffer length calculation

Fixes fd68b4739d2c ("vhost: use buffer vectors in dequeue path")
Reported-by Yinan Wang <[email protected]>
Signed-off-by Tiwei Bie <[email protected]>
---
 lib/librte_vhost/virtio_net.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
lib/librte_vhost/virtio_net.c +2 -1
index 2b7ffcf92..07cc0c845 100644
@@ -720,7 +720,8 @@ copy_mbuf_to_desc(struct virtio_net *dev, struct
 vhost_virtqueue *vq,
 				uint16_t hdr_vec_idx = 0;
 
 				while (remain) {
-					len = remain;
+					len = RTE_MIN(remain,
+
 	buf_vec[hdr_vec_idx].buf_len);
 					dst = buf_vec[hdr_vec_idx].buf_addr;
lib/librte_vhost/virtio_net.c +1 -1
 					rte_memcpy((void *)(uintptr_t)dst,
 							(void *)(uintptr_t)src,

@@ -747,7 +748,7 @@ copy_mbuf_to_desc(struct virtio_net *dev, struct
 vhost_virtqueue *vq,
 			hdr_addr = 0;
 		}
 
-		cpy_len = RTE_MIN(buf_len, mbuf_avail);
+		cpy_len = RTE_MIN(buf_avail, mbuf_avail);
 
 		if (likely(cpy_len > MAX_BATCH_LEN ||

vq->batch_copy_nb_elems >= vq-

Quoted 1 line

size)) {

lib/librte_vhost/virtio_net.c +2 -1
@@ -1112,7 +1113,8 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct
 vhost_virtqueue *vq,
 			 * in a contiguous virtual area.
 			 */
 			while (remain) {
-				len = remain;
+				len = RTE_MIN(remain,
+					buf_vec[hdr_vec_idx].buf_len);
 				src = buf_vec[hdr_vec_idx].buf_addr;
 				rte_memcpy((void *)(uintptr_t)dst,
Quoted 3 lines

(void *)(uintptr_t)src, len);
--
2.18.0

Acked-by Zhihong Wang <[email protected]>

Thanks

A message that is not in the archive (sent off-list or not yet received): 20180719020531.GA16332@debian

#5 lore raw
Quoted 7 lines · Tiwei Bie
Quoted 4 lines · Tiwei Bie
Fixes fd68b4739d2c ("vhost: use buffer vectors in dequeue path")
Reported-by Yinan Wang <[email protected]>
Signed-off-by Tiwei Bie <[email protected]>

Applied to dpdk-next-virtio/master, thanks.

It would be great to get this patch into main tree ASAP, since meson build with gcc 8 is currently broken on master. [Using Fedora 28].

../lib/librte_vhost/virtio_net.c: In function ‘rte_vhost_enqueue_burst’:
cc1: error: ‘__builtin_memcpy’ forming offset [13, 64] is out of the bounds [0, 12] of object ‘tmp_hdr’ with type ‘struct virtio_net_hdr_mrg_rxbuf’ [-Werror=array-bounds] ../lib/librte_vhost/virtio_net.c:636:34: note: ‘tmp_hdr’ declared here

  struct virtio_net_hdr_mrg_rxbuf tmp_hdr, *hdr = NULL;
                                  ^~~~~~~

cc1: error: ‘__builtin_memcpy’ forming offset [13, 64] is out of the bounds [0, 12] of object ‘tmp_hdr’ with type ‘struct virtio_net_hdr_mrg_rxbuf’ [-Werror=array-bounds] ../lib/librte_vhost/virtio_net.c:636:34: note: ‘tmp_hdr’ declared here
cc1: all warnings being treated as errors
ninja: build stopped: subcommand failed.

Regards,
/Bruce