diff mbox series

[v2] virtio: fix buffer leak on vlan insert

Message ID 20190405163115.5068-1-stephen@networkplumber.org (mailing list archive)
State Accepted, archived
Delegated to: Maxime Coquelin
Headers
Series [v2] virtio: fix buffer leak on vlan insert |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/mellanox-Performance-Testing success Performance Testing PASS
ci/intel-Performance-Testing success Performance Testing PASS
ci/Intel-compilation success Compilation OK

Commit Message

Stephen Hemminger April 5, 2019, 4:31 p.m. UTC 
  The function rte_vlan_insert may allocate a new buffer for the
vlan header and return a different mbuf than originally passed.
In this case, the stored mbuf in txm[] array could point to wrong
buffer.

Fixes: dd856dfcb9e7 ("virtio: use any layout on Tx")
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
v2 - catch a couple more places.
     The virtio code needs some refactoring to not have 3 copies of same
     loop...

 drivers/net/virtio/virtio_rxtx.c | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Jens Freimann April 8, 2019, 9:21 a.m. UTC | #1 
On Fri, Apr 05, 2019 at 09:31:15AM -0700, Stephen Hemminger wrote:
>The function rte_vlan_insert may allocate a new buffer for the
>vlan header and return a different mbuf than originally passed.
>In this case, the stored mbuf in txm[] array could point to wrong
>buffer.
>
>Fixes: dd856dfcb9e7 ("virtio: use any layout on Tx")
>Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
>---
>v2 - catch a couple more places.
>     The virtio code needs some refactoring to not have 3 copies of same
>     loop...
>
> drivers/net/virtio/virtio_rxtx.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>

Added stable@ back to Cc list as it was for v1. 

Reviewed-by: Jens Freimann <jfreimann@redhat.com>
Maxime Coquelin April 17, 2019, 7:16 a.m. UTC | #2 
On 4/5/19 6:31 PM, Stephen Hemminger wrote:
> The function rte_vlan_insert may allocate a new buffer for the
> vlan header and return a different mbuf than originally passed.
> In this case, the stored mbuf in txm[] array could point to wrong
> buffer.
> 
> Fixes: dd856dfcb9e7 ("virtio: use any layout on Tx")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> ---
> v2 - catch a couple more places.
>       The virtio code needs some refactoring to not have 3 copies of same
>       loop...
> 
>   drivers/net/virtio/virtio_rxtx.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 

Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

Thanks,
Maxime
Maxime Coquelin April 17, 2019, 7:56 a.m. UTC | #3 
On 4/5/19 6:31 PM, Stephen Hemminger wrote:
> The function rte_vlan_insert may allocate a new buffer for the
> vlan header and return a different mbuf than originally passed.
> In this case, the stored mbuf in txm[] array could point to wrong
> buffer.
> 
> Fixes: dd856dfcb9e7 ("virtio: use any layout on Tx")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> ---
> v2 - catch a couple more places.
>       The virtio code needs some refactoring to not have 3 copies of same
>       loop...
> 
>   drivers/net/virtio/virtio_rxtx.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 

Applied to dpdk-next-virtio/master.

Note that I fixed the commit title so that it passes check-git-log
script.

Thanks,
Maxime
diff mbox series

Patch

diff --git a/drivers/net/virtio/virtio_rxtx.c b/drivers/net/virtio/virtio_rxtx.c
index e6f3706d6fe1..8c56f238f965 100644
--- a/drivers/net/virtio/virtio_rxtx.c
+++ b/drivers/net/virtio/virtio_rxtx.c
@@ -2003,6 +2003,8 @@  virtio_xmit_pkts_packed(void *tx_queue, struct rte_mbuf **tx_pkts,
 				rte_pktmbuf_free(txm);
 				continue;
 			}
+			/* vlan_insert may add a header mbuf */
+			tx_pkts[nb_tx] = txm;
 		}
 
 		/* optimize ring usage */
@@ -2090,6 +2092,8 @@  virtio_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts, uint16_t nb_pkts)
 				rte_pktmbuf_free(txm);
 				continue;
 			}
+			/* vlan_insert may add a header mbuf */
+			tx_pkts[nb_tx] = txm;
 		}
 
 		/* optimize ring usage */
@@ -2193,6 +2197,8 @@  virtio_xmit_pkts_inorder(void *tx_queue,
 				rte_pktmbuf_free(txm);
 				continue;
 			}
+			/* vlan_insert may add a header mbuf */
+			tx_pkts[nb_tx] = txm;
 		}
 
 		/* optimize ring usage */