From 3ebd930588b7847906e08e2645a35761a90abf2a Mon Sep 17 00:00:00 2001 From: Junjie Chen Date: Wed, 17 Jan 2018 10:45:53 -0500 Subject: [PATCH] vhost: fix mbuf free dequeue zero copy change buf_addr and buf_iova of mbuf, and return to mbuf pool without restore them, it breaks vm memory if others allocate mbuf from same pool since mbuf reset doesn't reset buf_addr and buf_iova. Fixes: b0a985d1f340 ("vhost: add dequeue zero copy") Cc: stable@dpdk.org Signed-off-by: Junjie Chen Reviewed-by: Maxime Coquelin Acked-by: Yuanhan Liu --- lib/librte_vhost/virtio_net.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index a1d8026071..8ef71ccca7 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -1082,6 +1082,22 @@ mbuf_is_consumed(struct rte_mbuf *m) return true; } +static __rte_always_inline void +restore_mbuf(struct rte_mbuf *m) +{ + uint32_t mbuf_size, priv_size; + + while (m) { + priv_size = rte_pktmbuf_priv_size(m->pool); + mbuf_size = sizeof(struct rte_mbuf) + priv_size; + /* start of buffer is after mbuf structure and priv data */ + + m->buf_addr = (char *)m + mbuf_size; + m->buf_iova = rte_mempool_virt2iova(m) + mbuf_size; + m = m->next; + } +} + uint16_t rte_vhost_dequeue_burst(int vid, uint16_t queue_id, struct rte_mempool *mbuf_pool, struct rte_mbuf **pkts, uint16_t count) @@ -1133,6 +1149,7 @@ rte_vhost_dequeue_burst(int vid, uint16_t queue_id, nr_updated += 1; TAILQ_REMOVE(&vq->zmbuf_list, zmbuf, next); + restore_mbuf(zmbuf->mbuf); rte_pktmbuf_free(zmbuf->mbuf); put_zmbuf(zmbuf); vq->nr_zmbuf -= 1; -- 2.20.1