d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

virtio: fix segfault on Tx desc flags setup

Browse Source 
After the do-while loop, idx could be VQ_RING_DESC_CHAIN_END (32768)
when it's the last vring desc buf we can get. Therefore, following
expresssion could lead to a segfault error, as it tries to access
beyond the desc memory boundary.

    start_dp[idx].flags &= ~VRING_DESC_F_NEXT;

This bug could be reproduced easily with "set fwd txonly" in the
guest PMD, where the dequeue on host is slower than the guest Tx,
that running out of free desc buf is pretty easy.

The fix is straightforward and easy, just remove it, as we have
already set desc flags properly inside the do-while loop.

Fixes: dd856dfcb9 ("virtio: use any layout on Tx")

[Yuanhan Liu: commit log reword]
Signed-off-by: Jianfeng Tan <jianfeng.tan@intel.com>
Acked-by: Huawei Xie <huawei.xie@intel.com>
Acked-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
This commit is contained in:
Jianfeng Tan 2016-04-25 02:37:45 +00:00 committed by Yuanhan Liu
parent e908312704
commit 2c0eb46f51
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/virtio/virtio_rxtx.c
View File

@ -271,8 +271,6 @@ virtqueue_enqueue_xmit(struct virtqueue *txvq, struct rte_mbuf *cookie,
idx = start_dp[idx].next;
} while ((cookie = cookie->next) != NULL);
start_dp[idx].flags &= ~VRING_DESC_F_NEXT;
if (use_indirect)
idx = txvq->vq_ring.desc[head_idx].next;