1 | The following changes since commit 9303ecb658a0194560d1eecde165a1511223c2d8: | 1 | The following changes since commit 23895cbd82be95428e90168b12e925d0d3ca2f06: |
---|---|---|---|
2 | 2 | ||
3 | Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200727' into staging (2020-07-27 17:25:06 +0100) | 3 | Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201123.0' into staging (2020-11-23 18:51:13 +0000) |
4 | 4 | ||
5 | are available in the git repository at: | 5 | are available in the git repository at: |
6 | 6 | ||
7 | https://github.com/jasowang/qemu.git tags/net-pull-request | 7 | https://github.com/jasowang/qemu.git tags/net-pull-request |
8 | 8 | ||
9 | for you to fetch changes up to 7142cad78d6bf4a1cbcb09d06b39935a7998c24e: | 9 | for you to fetch changes up to 9925990d01a92564af55f6f69d0f5f59b47609b1: |
10 | 10 | ||
11 | net: forbid the reentrant RX (2020-07-28 13:50:41 +0800) | 11 | net: Use correct default-path macro for downscript (2020-11-24 10:40:17 +0800) |
12 | 12 | ||
13 | ---------------------------------------------------------------- | 13 | ---------------------------------------------------------------- |
14 | Want to send earlier but most patches just come. | ||
15 | |||
16 | - fix vhost-vdpa issues when no peer | ||
17 | - fix virtio-pci queue enabling check | ||
18 | - forbid reentrant RX | ||
19 | 14 | ||
20 | ---------------------------------------------------------------- | 15 | ---------------------------------------------------------------- |
21 | Jason Wang (2): | 16 | Keqian Zhu (1): |
22 | virtio-net: check the existence of peer before accessing vDPA config | 17 | net: Use correct default-path macro for downscript |
23 | net: forbid the reentrant RX | ||
24 | 18 | ||
25 | Laurent Vivier (1): | 19 | Paolo Bonzini (1): |
26 | virtio-pci: fix virtio_pci_queue_enabled() | 20 | net: do not exit on "netdev_add help" monitor command |
21 | |||
22 | Prasad J Pandit (1): | ||
23 | hw/net/e1000e: advance desc_offset in case of null descriptor | ||
27 | 24 | ||
28 | Yuri Benditovich (1): | 25 | Yuri Benditovich (1): |
29 | virtio-pci: fix wrong index in virtio_pci_queue_enabled | 26 | net: purge queued rx packets on queue deletion |
30 | 27 | ||
31 | hw/net/virtio-net.c | 30 +++++++++++++++++++----------- | 28 | yuanjungong (1): |
32 | hw/virtio/virtio-pci.c | 4 ++-- | 29 | tap: fix a memory leak |
33 | hw/virtio/virtio.c | 7 ++++++- | 30 | |
34 | include/hw/virtio/virtio.h | 1 + | 31 | hw/net/e1000e_core.c | 8 +++--- |
35 | net/queue.c | 3 +++ | 32 | include/net/net.h | 1 + |
36 | 5 files changed, 31 insertions(+), 14 deletions(-) | 33 | monitor/hmp-cmds.c | 6 ++++ |
34 | net/net.c | 80 +++++++++++++++++++++++++++------------------------- | ||
35 | net/tap.c | 5 +++- | ||
36 | 5 files changed, 57 insertions(+), 43 deletions(-) | ||
37 | 37 | ||
38 | 38 | ||
39 | diff view generated by jsdifflib |
New patch | |||
---|---|---|---|
1 | From: Prasad J Pandit <pjp@fedoraproject.org> | ||
1 | 2 | ||
3 | While receiving packets via e1000e_write_packet_to_guest() routine, | ||
4 | 'desc_offset' is advanced only when RX descriptor is processed. And | ||
5 | RX descriptor is not processed if it has NULL buffer address. | ||
6 | This may lead to an infinite loop condition. Increament 'desc_offset' | ||
7 | to process next descriptor in the ring to avoid infinite loop. | ||
8 | |||
9 | Reported-by: Cheol-woo Myung <330cjfdn@gmail.com> | ||
10 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | ||
11 | Signed-off-by: Jason Wang <jasowang@redhat.com> | ||
12 | --- | ||
13 | hw/net/e1000e_core.c | 8 ++++---- | ||
14 | 1 file changed, 4 insertions(+), 4 deletions(-) | ||
15 | |||
16 | diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c | ||
17 | index XXXXXXX..XXXXXXX 100644 | ||
18 | --- a/hw/net/e1000e_core.c | ||
19 | +++ b/hw/net/e1000e_core.c | ||
20 | @@ -XXX,XX +XXX,XX @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt, | ||
21 | (const char *) &fcs_pad, e1000x_fcs_len(core->mac)); | ||
22 | } | ||
23 | } | ||
24 | - desc_offset += desc_size; | ||
25 | - if (desc_offset >= total_size) { | ||
26 | - is_last = true; | ||
27 | - } | ||
28 | } else { /* as per intel docs; skip descriptors with null buf addr */ | ||
29 | trace_e1000e_rx_null_descriptor(); | ||
30 | } | ||
31 | + desc_offset += desc_size; | ||
32 | + if (desc_offset >= total_size) { | ||
33 | + is_last = true; | ||
34 | + } | ||
35 | |||
36 | e1000e_write_rx_descr(core, desc, is_last ? core->rx_pkt : NULL, | ||
37 | rss_info, do_ps ? ps_hdr_len : 0, &bastate.written); | ||
38 | -- | ||
39 | 2.7.4 | ||
40 | |||
41 | diff view generated by jsdifflib |
1 | We try to check whether a peer is VDPA in order to get config from | 1 | From: Paolo Bonzini <pbonzini@redhat.com> |
---|---|---|---|
2 | there - with no peer, this leads to a NULL | ||
3 | pointer dereference. Add a check before trying to access the peer | ||
4 | type. No peer means not VDPA. | ||
5 | 2 | ||
6 | Fixes: 108a64818e69b ("vhost-vdpa: introduce vhost-vdpa backend") | 3 | "netdev_add help" is causing QEMU to exit because the code that |
7 | Cc: Cindy Lu <lulu@redhat.com> | 4 | invokes show_netdevs is shared between CLI and HMP processing. |
8 | Tested-by: Cornelia Huck <cohuck@redhat.com> | 5 | Move the check to the callers so that exit(0) remains only |
9 | Reviewed-by: Cornelia Huck <cohuck@redhat.com> | 6 | in the CLI flow. |
7 | |||
8 | "netdev_add help" is not fixed by this patch; that is left for | ||
9 | later work. | ||
10 | |||
11 | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | ||
10 | Signed-off-by: Jason Wang <jasowang@redhat.com> | 12 | Signed-off-by: Jason Wang <jasowang@redhat.com> |
11 | --- | 13 | --- |
12 | hw/net/virtio-net.c | 30 +++++++++++++++++++----------- | 14 | include/net/net.h | 1 + |
13 | 1 file changed, 19 insertions(+), 11 deletions(-) | 15 | monitor/hmp-cmds.c | 6 +++++ |
16 | net/net.c | 68 +++++++++++++++++++++++++++--------------------------- | ||
17 | 3 files changed, 41 insertions(+), 34 deletions(-) | ||
14 | 18 | ||
15 | diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c | 19 | diff --git a/include/net/net.h b/include/net/net.h |
16 | index XXXXXXX..XXXXXXX 100644 | 20 | index XXXXXXX..XXXXXXX 100644 |
17 | --- a/hw/net/virtio-net.c | 21 | --- a/include/net/net.h |
18 | +++ b/hw/net/virtio-net.c | 22 | +++ b/include/net/net.h |
19 | @@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config) | 23 | @@ -XXX,XX +XXX,XX @@ extern const char *host_net_devices[]; |
24 | |||
25 | /* from net.c */ | ||
26 | int net_client_parse(QemuOptsList *opts_list, const char *str); | ||
27 | +void show_netdevs(void); | ||
28 | int net_init_clients(Error **errp); | ||
29 | void net_check_clients(void); | ||
30 | void net_cleanup(void); | ||
31 | diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c | ||
32 | index XXXXXXX..XXXXXXX 100644 | ||
33 | --- a/monitor/hmp-cmds.c | ||
34 | +++ b/monitor/hmp-cmds.c | ||
35 | @@ -XXX,XX +XXX,XX @@ | ||
36 | #include "qemu/option.h" | ||
37 | #include "qemu/timer.h" | ||
38 | #include "qemu/sockets.h" | ||
39 | +#include "qemu/help_option.h" | ||
40 | #include "monitor/monitor-internal.h" | ||
41 | #include "qapi/error.h" | ||
42 | #include "qapi/clone-visitor.h" | ||
43 | @@ -XXX,XX +XXX,XX @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict) | ||
20 | { | 44 | { |
21 | VirtIONet *n = VIRTIO_NET(vdev); | 45 | Error *err = NULL; |
22 | struct virtio_net_config netcfg; | 46 | QemuOpts *opts; |
23 | + NetClientState *nc = qemu_get_queue(n->nic); | 47 | + const char *type = qdict_get_try_str(qdict, "type"); |
24 | 48 | ||
25 | int ret = 0; | 49 | + if (type && is_help_option(type)) { |
26 | memset(&netcfg, 0 , sizeof(struct virtio_net_config)); | 50 | + show_netdevs(); |
27 | @@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config) | 51 | + return; |
28 | VIRTIO_NET_RSS_SUPPORTED_HASHES); | 52 | + } |
29 | memcpy(config, &netcfg, n->config_size); | 53 | opts = qemu_opts_from_qdict(qemu_find_opts("netdev"), qdict, &err); |
30 | 54 | if (err) { | |
31 | - NetClientState *nc = qemu_get_queue(n->nic); | 55 | goto out; |
32 | - if (nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_VDPA) { | 56 | diff --git a/net/net.c b/net/net.c |
33 | + /* | 57 | index XXXXXXX..XXXXXXX 100644 |
34 | + * Is this VDPA? No peer means not VDPA: there's no way to | 58 | --- a/net/net.c |
35 | + * disconnect/reconnect a VDPA peer. | 59 | +++ b/net/net.c |
36 | + */ | 60 | @@ -XXX,XX +XXX,XX @@ |
37 | + if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_VDPA) { | 61 | #include "qemu/config-file.h" |
38 | ret = vhost_net_get_config(get_vhost_net(nc->peer), (uint8_t *)&netcfg, | 62 | #include "qemu/ctype.h" |
39 | - n->config_size); | 63 | #include "qemu/iov.h" |
40 | - if (ret != -1) { | 64 | +#include "qemu/qemu-print.h" |
41 | - memcpy(config, &netcfg, n->config_size); | 65 | #include "qemu/main-loop.h" |
42 | - } | 66 | #include "qemu/option.h" |
43 | + n->config_size); | 67 | #include "qapi/error.h" |
44 | + if (ret != -1) { | 68 | @@ -XXX,XX +XXX,XX @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp) |
45 | + memcpy(config, &netcfg, n->config_size); | 69 | return 0; |
46 | + } | 70 | } |
71 | |||
72 | -static void show_netdevs(void) | ||
73 | +void show_netdevs(void) | ||
74 | { | ||
75 | int idx; | ||
76 | const char *available_netdevs[] = { | ||
77 | @@ -XXX,XX +XXX,XX @@ static void show_netdevs(void) | ||
78 | #endif | ||
79 | }; | ||
80 | |||
81 | - printf("Available netdev backend types:\n"); | ||
82 | + qemu_printf("Available netdev backend types:\n"); | ||
83 | for (idx = 0; idx < ARRAY_SIZE(available_netdevs); idx++) { | ||
84 | - puts(available_netdevs[idx]); | ||
85 | + qemu_printf("%s\n", available_netdevs[idx]); | ||
47 | } | 86 | } |
48 | } | 87 | } |
49 | 88 | ||
50 | @@ -XXX,XX +XXX,XX @@ static void virtio_net_set_config(VirtIODevice *vdev, const uint8_t *config) | 89 | @@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp) |
90 | int ret = -1; | ||
91 | Visitor *v = opts_visitor_new(opts); | ||
92 | |||
93 | - const char *type = qemu_opt_get(opts, "type"); | ||
94 | - | ||
95 | - if (is_netdev && type && is_help_option(type)) { | ||
96 | - show_netdevs(); | ||
97 | - exit(0); | ||
98 | - } else { | ||
99 | - /* Parse convenience option format ip6-net=fec0::0[/64] */ | ||
100 | - const char *ip6_net = qemu_opt_get(opts, "ipv6-net"); | ||
101 | + /* Parse convenience option format ip6-net=fec0::0[/64] */ | ||
102 | + const char *ip6_net = qemu_opt_get(opts, "ipv6-net"); | ||
103 | |||
104 | - if (ip6_net) { | ||
105 | - char *prefix_addr; | ||
106 | - unsigned long prefix_len = 64; /* Default 64bit prefix length. */ | ||
107 | + if (ip6_net) { | ||
108 | + char *prefix_addr; | ||
109 | + unsigned long prefix_len = 64; /* Default 64bit prefix length. */ | ||
110 | |||
111 | - substrings = g_strsplit(ip6_net, "/", 2); | ||
112 | - if (!substrings || !substrings[0]) { | ||
113 | - error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net", | ||
114 | - "a valid IPv6 prefix"); | ||
115 | - goto out; | ||
116 | - } | ||
117 | + substrings = g_strsplit(ip6_net, "/", 2); | ||
118 | + if (!substrings || !substrings[0]) { | ||
119 | + error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net", | ||
120 | + "a valid IPv6 prefix"); | ||
121 | + goto out; | ||
122 | + } | ||
123 | |||
124 | - prefix_addr = substrings[0]; | ||
125 | + prefix_addr = substrings[0]; | ||
126 | |||
127 | - /* Handle user-specified prefix length. */ | ||
128 | - if (substrings[1] && | ||
129 | - qemu_strtoul(substrings[1], NULL, 10, &prefix_len)) | ||
130 | - { | ||
131 | - error_setg(errp, QERR_INVALID_PARAMETER_VALUE, | ||
132 | - "ipv6-prefixlen", "a number"); | ||
133 | - goto out; | ||
134 | - } | ||
135 | - | ||
136 | - qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort); | ||
137 | - qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len, | ||
138 | - &error_abort); | ||
139 | - qemu_opt_unset(opts, "ipv6-net"); | ||
140 | + /* Handle user-specified prefix length. */ | ||
141 | + if (substrings[1] && | ||
142 | + qemu_strtoul(substrings[1], NULL, 10, &prefix_len)) | ||
143 | + { | ||
144 | + error_setg(errp, QERR_INVALID_PARAMETER_VALUE, | ||
145 | + "ipv6-prefixlen", "a number"); | ||
146 | + goto out; | ||
147 | } | ||
148 | + | ||
149 | + qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort); | ||
150 | + qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len, | ||
151 | + &error_abort); | ||
152 | + qemu_opt_unset(opts, "ipv6-net"); | ||
153 | } | ||
154 | |||
155 | /* Create an ID for -net if the user did not specify one */ | ||
156 | @@ -XXX,XX +XXX,XX @@ static int net_init_client(void *dummy, QemuOpts *opts, Error **errp) | ||
157 | |||
158 | static int net_init_netdev(void *dummy, QemuOpts *opts, Error **errp) | ||
51 | { | 159 | { |
52 | VirtIONet *n = VIRTIO_NET(vdev); | 160 | + const char *type = qemu_opt_get(opts, "type"); |
53 | struct virtio_net_config netcfg = {}; | 161 | + |
54 | + NetClientState *nc = qemu_get_queue(n->nic); | 162 | + if (type && is_help_option(type)) { |
55 | 163 | + show_netdevs(); | |
56 | memcpy(&netcfg, config, n->config_size); | 164 | + exit(0); |
57 | 165 | + } | |
58 | @@ -XXX,XX +XXX,XX @@ static void virtio_net_set_config(VirtIODevice *vdev, const uint8_t *config) | 166 | return net_client_init(opts, true, errp); |
59 | qemu_format_nic_info_str(qemu_get_queue(n->nic), n->mac); | ||
60 | } | ||
61 | |||
62 | - NetClientState *nc = qemu_get_queue(n->nic); | ||
63 | - if (nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_VDPA) { | ||
64 | - vhost_net_set_config(get_vhost_net(nc->peer), (uint8_t *)&netcfg, | ||
65 | - 0, n->config_size, | ||
66 | - VHOST_SET_CONFIG_TYPE_MASTER); | ||
67 | + /* | ||
68 | + * Is this VDPA? No peer means not VDPA: there's no way to | ||
69 | + * disconnect/reconnect a VDPA peer. | ||
70 | + */ | ||
71 | + if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_VHOST_VDPA) { | ||
72 | + vhost_net_set_config(get_vhost_net(nc->peer), | ||
73 | + (uint8_t *)&netcfg, 0, n->config_size, | ||
74 | + VHOST_SET_CONFIG_TYPE_MASTER); | ||
75 | } | ||
76 | } | 167 | } |
77 | 168 | ||
78 | -- | 169 | -- |
79 | 2.7.4 | 170 | 2.7.4 |
80 | 171 | ||
81 | 172 | diff view generated by jsdifflib |
1 | From: Yuri Benditovich <yuri.benditovich@daynix.com> | 1 | From: Yuri Benditovich <yuri.benditovich@daynix.com> |
---|---|---|---|
2 | 2 | ||
3 | https://bugzilla.redhat.com/show_bug.cgi?id=1702608 | 3 | https://bugzilla.redhat.com/show_bug.cgi?id=1829272 |
4 | When deleting queue pair, purge pending RX packets if any. | ||
5 | Example of problematic flow: | ||
6 | 1. Bring up q35 VM with tap (vhost off) and virtio-net or e1000e | ||
7 | 2. Run ping flood to the VM NIC ( 1 ms interval) | ||
8 | 3. Hot unplug the NIC device (device_del) | ||
9 | During unplug process one or more packets come, the NIC | ||
10 | can't receive, tap disables read_poll | ||
11 | 4. Hot plug the device (device_add) with the same netdev | ||
12 | The tap stays with read_poll disabled and does not receive | ||
13 | any packets anymore (tap_send never triggered) | ||
4 | 14 | ||
5 | Fixes: f19bcdfedd53 ("virtio-pci: implement queue_enabled method") | ||
6 | Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com> | 15 | Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com> |
7 | Signed-off-by: Jason Wang <jasowang@redhat.com> | 16 | Signed-off-by: Jason Wang <jasowang@redhat.com> |
8 | --- | 17 | --- |
9 | hw/virtio/virtio-pci.c | 2 +- | 18 | net/net.c | 12 ++++++++---- |
10 | 1 file changed, 1 insertion(+), 1 deletion(-) | 19 | 1 file changed, 8 insertions(+), 4 deletions(-) |
11 | 20 | ||
12 | diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c | 21 | diff --git a/net/net.c b/net/net.c |
13 | index XXXXXXX..XXXXXXX 100644 | 22 | index XXXXXXX..XXXXXXX 100644 |
14 | --- a/hw/virtio/virtio-pci.c | 23 | --- a/net/net.c |
15 | +++ b/hw/virtio/virtio-pci.c | 24 | +++ b/net/net.c |
16 | @@ -XXX,XX +XXX,XX @@ static bool virtio_pci_queue_enabled(DeviceState *d, int n) | 25 | @@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic) |
17 | VirtIODevice *vdev = virtio_bus_get_device(&proxy->bus); | 26 | |
18 | 27 | qemu_macaddr_set_free(&nic->conf->macaddr); | |
19 | if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) { | 28 | |
20 | - return proxy->vqs[vdev->queue_sel].enabled; | 29 | - /* If this is a peer NIC and peer has already been deleted, free it now. */ |
21 | + return proxy->vqs[n].enabled; | 30 | - if (nic->peer_deleted) { |
31 | - for (i = 0; i < queues; i++) { | ||
32 | - qemu_free_net_client(qemu_get_subqueue(nic, i)->peer); | ||
33 | + for (i = 0; i < queues; i++) { | ||
34 | + NetClientState *nc = qemu_get_subqueue(nic, i); | ||
35 | + /* If this is a peer NIC and peer has already been deleted, free it now. */ | ||
36 | + if (nic->peer_deleted) { | ||
37 | + qemu_free_net_client(nc->peer); | ||
38 | + } else if (nc->peer) { | ||
39 | + /* if there are RX packets pending, complete them */ | ||
40 | + qemu_purge_queued_packets(nc->peer); | ||
41 | } | ||
22 | } | 42 | } |
23 | 43 | ||
24 | return virtio_queue_enabled(vdev, n); | ||
25 | -- | 44 | -- |
26 | 2.7.4 | 45 | 2.7.4 |
27 | 46 | ||
28 | 47 | diff view generated by jsdifflib |
1 | The memory API allows DMA into NIC's MMIO area. This means the NIC's | 1 | From: yuanjungong <ruc_gongyuanjun@163.com> |
---|---|---|---|
2 | RX routine must be reentrant. Instead of auditing all the NIC, we can | ||
3 | simply detect the reentrancy and return early. The queue->delivering | ||
4 | is set and cleared by qemu_net_queue_deliver() for other queue helpers | ||
5 | to know whether the delivering in on going (NIC's receive is being | ||
6 | called). We can check it and return early in qemu_net_queue_flush() to | ||
7 | forbid reentrant RX. | ||
8 | 2 | ||
3 | Close fd before returning. | ||
4 | |||
5 | Buglink: https://bugs.launchpad.net/qemu/+bug/1904486 | ||
6 | |||
7 | Signed-off-by: yuanjungong <ruc_gongyuanjun@163.com> | ||
8 | Reviewed-by: Peter Maydell <peter.maydell@linaro.org> | ||
9 | Signed-off-by: Jason Wang <jasowang@redhat.com> | 9 | Signed-off-by: Jason Wang <jasowang@redhat.com> |
10 | --- | 10 | --- |
11 | net/queue.c | 3 +++ | 11 | net/tap.c | 2 ++ |
12 | 1 file changed, 3 insertions(+) | 12 | 1 file changed, 2 insertions(+) |
13 | 13 | ||
14 | diff --git a/net/queue.c b/net/queue.c | 14 | diff --git a/net/tap.c b/net/tap.c |
15 | index XXXXXXX..XXXXXXX 100644 | 15 | index XXXXXXX..XXXXXXX 100644 |
16 | --- a/net/queue.c | 16 | --- a/net/tap.c |
17 | +++ b/net/queue.c | 17 | +++ b/net/tap.c |
18 | @@ -XXX,XX +XXX,XX @@ void qemu_net_queue_purge(NetQueue *queue, NetClientState *from) | 18 | @@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name, |
19 | 19 | if (ret < 0) { | |
20 | bool qemu_net_queue_flush(NetQueue *queue) | 20 | error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d", |
21 | { | 21 | name, fd); |
22 | + if (queue->delivering) | 22 | + close(fd); |
23 | + return false; | 23 | return -1; |
24 | + | 24 | } |
25 | while (!QTAILQ_EMPTY(&queue->packets)) { | 25 | |
26 | NetPacket *packet; | 26 | @@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name, |
27 | int ret; | 27 | vhostfdname, vnet_hdr, fd, &err); |
28 | if (err) { | ||
29 | error_propagate(errp, err); | ||
30 | + close(fd); | ||
31 | return -1; | ||
32 | } | ||
33 | } else if (tap->has_fds) { | ||
28 | -- | 34 | -- |
29 | 2.7.4 | 35 | 2.7.4 |
30 | 36 | ||
31 | 37 | diff view generated by jsdifflib |
1 | From: Laurent Vivier <lvivier@redhat.com> | 1 | From: Keqian Zhu <zhukeqian1@huawei.com> |
---|---|---|---|
2 | 2 | ||
3 | In legacy mode, virtio_pci_queue_enabled() falls back to | 3 | Fixes: 63c4db4c2e6d (net: relocate paths to helpers and scripts) |
4 | virtio_queue_enabled() to know if the queue is enabled. | 4 | Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com> |
5 | |||
6 | But virtio_queue_enabled() calls again virtio_pci_queue_enabled() | ||
7 | if k->queue_enabled is set. This ends in a crash after a stack | ||
8 | overflow. | ||
9 | |||
10 | The problem can be reproduced with | ||
11 | "-device virtio-net-pci,disable-legacy=off,disable-modern=true | ||
12 | -net tap,vhost=on" | ||
13 | |||
14 | And a look to the backtrace is very explicit: | ||
15 | |||
16 | ... | ||
17 | #4 0x000000010029a438 in virtio_queue_enabled () | ||
18 | #5 0x0000000100497a9c in virtio_pci_queue_enabled () | ||
19 | ... | ||
20 | #130902 0x000000010029a460 in virtio_queue_enabled () | ||
21 | #130903 0x0000000100497a9c in virtio_pci_queue_enabled () | ||
22 | #130904 0x000000010029a460 in virtio_queue_enabled () | ||
23 | #130905 0x0000000100454a20 in vhost_net_start () | ||
24 | ... | ||
25 | |||
26 | This patch fixes the problem by introducing a new function | ||
27 | for the legacy case and calls it from virtio_pci_queue_enabled(). | ||
28 | It also calls it from virtio_queue_enabled() to avoid code duplication. | ||
29 | |||
30 | Fixes: f19bcdfedd53 ("virtio-pci: implement queue_enabled method") | ||
31 | Cc: Jason Wang <jasowang@redhat.com> | ||
32 | Cc: Cindy Lu <lulu@redhat.com> | ||
33 | CC: Michael S. Tsirkin <mst@redhat.com> | ||
34 | Reviewed-by: Richard Henderson <richard.henderson@linaro.org> | ||
35 | Signed-off-by: Laurent Vivier <lvivier@redhat.com> | ||
36 | Signed-off-by: Jason Wang <jasowang@redhat.com> | 5 | Signed-off-by: Jason Wang <jasowang@redhat.com> |
37 | --- | 6 | --- |
38 | hw/virtio/virtio-pci.c | 2 +- | 7 | net/tap.c | 3 ++- |
39 | hw/virtio/virtio.c | 7 ++++++- | 8 | 1 file changed, 2 insertions(+), 1 deletion(-) |
40 | include/hw/virtio/virtio.h | 1 + | ||
41 | 3 files changed, 8 insertions(+), 2 deletions(-) | ||
42 | 9 | ||
43 | diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c | 10 | diff --git a/net/tap.c b/net/tap.c |
44 | index XXXXXXX..XXXXXXX 100644 | 11 | index XXXXXXX..XXXXXXX 100644 |
45 | --- a/hw/virtio/virtio-pci.c | 12 | --- a/net/tap.c |
46 | +++ b/hw/virtio/virtio-pci.c | 13 | +++ b/net/tap.c |
47 | @@ -XXX,XX +XXX,XX @@ static bool virtio_pci_queue_enabled(DeviceState *d, int n) | 14 | @@ -XXX,XX +XXX,XX @@ free_fail: |
48 | return proxy->vqs[n].enabled; | 15 | script = default_script = get_relocated_path(DEFAULT_NETWORK_SCRIPT); |
49 | } | 16 | } |
50 | 17 | if (!downscript) { | |
51 | - return virtio_queue_enabled(vdev, n); | 18 | - downscript = default_downscript = get_relocated_path(DEFAULT_NETWORK_SCRIPT); |
52 | + return virtio_queue_enabled_legacy(vdev, n); | 19 | + downscript = default_downscript = |
53 | } | 20 | + get_relocated_path(DEFAULT_NETWORK_DOWN_SCRIPT); |
54 | 21 | } | |
55 | static int virtio_pci_add_mem_cap(VirtIOPCIProxy *proxy, | 22 | |
56 | diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c | 23 | if (tap->has_ifname) { |
57 | index XXXXXXX..XXXXXXX 100644 | ||
58 | --- a/hw/virtio/virtio.c | ||
59 | +++ b/hw/virtio/virtio.c | ||
60 | @@ -XXX,XX +XXX,XX @@ hwaddr virtio_queue_get_desc_addr(VirtIODevice *vdev, int n) | ||
61 | return vdev->vq[n].vring.desc; | ||
62 | } | ||
63 | |||
64 | +bool virtio_queue_enabled_legacy(VirtIODevice *vdev, int n) | ||
65 | +{ | ||
66 | + return virtio_queue_get_desc_addr(vdev, n) != 0; | ||
67 | +} | ||
68 | + | ||
69 | bool virtio_queue_enabled(VirtIODevice *vdev, int n) | ||
70 | { | ||
71 | BusState *qbus = qdev_get_parent_bus(DEVICE(vdev)); | ||
72 | @@ -XXX,XX +XXX,XX @@ bool virtio_queue_enabled(VirtIODevice *vdev, int n) | ||
73 | if (k->queue_enabled) { | ||
74 | return k->queue_enabled(qbus->parent, n); | ||
75 | } | ||
76 | - return virtio_queue_get_desc_addr(vdev, n) != 0; | ||
77 | + return virtio_queue_enabled_legacy(vdev, n); | ||
78 | } | ||
79 | |||
80 | hwaddr virtio_queue_get_avail_addr(VirtIODevice *vdev, int n) | ||
81 | diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h | ||
82 | index XXXXXXX..XXXXXXX 100644 | ||
83 | --- a/include/hw/virtio/virtio.h | ||
84 | +++ b/include/hw/virtio/virtio.h | ||
85 | @@ -XXX,XX +XXX,XX @@ typedef struct VirtIORNGConf VirtIORNGConf; | ||
86 | VIRTIO_F_RING_PACKED, false) | ||
87 | |||
88 | hwaddr virtio_queue_get_desc_addr(VirtIODevice *vdev, int n); | ||
89 | +bool virtio_queue_enabled_legacy(VirtIODevice *vdev, int n); | ||
90 | bool virtio_queue_enabled(VirtIODevice *vdev, int n); | ||
91 | hwaddr virtio_queue_get_avail_addr(VirtIODevice *vdev, int n); | ||
92 | hwaddr virtio_queue_get_used_addr(VirtIODevice *vdev, int n); | ||
93 | -- | 24 | -- |
94 | 2.7.4 | 25 | 2.7.4 |
95 | 26 | ||
96 | 27 | diff view generated by jsdifflib |