Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0960b641 authored by Jason Wang's avatar Jason Wang Committed by David S. Miller
Browse files

vhost_net: fix wrong iter offset when setting number of buffers 

In commit ba7438ae ("vhost: don't bother copying iovecs in
handle_rx(), kill memcpy_toiovecend()"), we advance iov iter fixup
sizeof(struct virtio_net_hdr) bytes and fill the number of buffers
after doing the socket recvmsg(). This work well but was broken after
commit 6e03f896 ("Merge
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net") which tries
to advance sizeof(struct virtio_net_hdr_mrg_rxbuf). It will fill the
number of buffers at the wrong place. This patch fixes this.

Fixes 6e03f896
("Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net"

)
Cc: David S. Miller <davem@davemloft.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ca9f1fd2

drivers/vhost/net.c

+6 −5
Original line number Diff line number Diff line
@@ -528,9 +528,9 @@ static void handle_rx(struct vhost_net *net) 
		.msg_controllen = 0,

		.msg_flags = MSG_DONTWAIT,

	};

	struct virtio_net_hdr_mrg_rxbuf hdr = {

		.hdr.flags = 0,

		.hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE

	struct virtio_net_hdr hdr = {

		.flags = 0,

		.gso_type = VIRTIO_NET_HDR_GSO_NONE

	};

	size_t total_len = 0;

	int err, mergeable;
@@ -539,6 +539,7 @@ static void handle_rx(struct vhost_net *net) 
	size_t vhost_len, sock_len;

	struct socket *sock;

	struct iov_iter fixup;

	__virtio16 num_buffers;



	mutex_lock(&vq->mutex);

	sock = vq->private_data;
@@ -616,9 +617,9 @@ static void handle_rx(struct vhost_net *net) 
		}

		/* TODO: Should check and handle checksum. */



		hdr.num_buffers = cpu_to_vhost16(vq, headcount);

		num_buffers = cpu_to_vhost16(vq, headcount);

		if (likely(mergeable) &&

		    copy_to_iter(&hdr.num_buffers, 2, &fixup) != 2) {

		    copy_to_iter(&num_buffers, 2, &fixup) != 2) {

			vq_err(vq, "Failed num_buffers write");

			vhost_discard_vq_desc(vq, headcount);

			break;