From nobody Fri Apr 3 11:26:19 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2314C3DF004 for ; Tue, 24 Mar 2026 15:16:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774365363; cv=none; b=tvODjNlyjJYF36qSa9vFU9GkaTJNDwkN7qzwR9urhTMLVI1mzJ4dsQVPeiIMrcgbAxXDZDSNlfH+eplhbbHfxCGEFsnqErQK6Wb9GM3Hma9C+9FSes+mcOnHc+lW8W1rIuqQ5ffElY7JaVdQroGlQrRpiPA63LjkweA6uMvxv5U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774365363; c=relaxed/simple; bh=0DAQT5hcnfFP7UoqaO6an4vhVS498McC5K6b/zfmBDc=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=FTJ05KJYg1IpCheZyPowz2FY1+yUpqiD7kYoon5w1l+SF6hFgjT713LK5GCw/P1FtpGDJwnRSxn3pNS7oxcJCndkKyIKB7xDeV5TGSJBJPlB94on2kFpAuXy3/cWhFsU+R9Ipbz29SylmanM0gmj52Vjx+SlOTMM0kW8sF4IsOs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=YPvt3Jgd; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=cTiqyWVX; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="YPvt3Jgd"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="cTiqyWVX" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774365361; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type; bh=zZaZ+weNFt/DeQ+y853Qd9D2vVvyy8X2coFZA5Jbyn4=; b=YPvt3JgdxNP0aJ9mB3lNrPhe3LBAwhkxcsdfSmD5LbScEwcBv+gmeeXYNo6TRkHRW72uww ea+79So5XUR92xLsgx6V5bG0UvK2TqqQNJT6st0Al2YxcdX5mFSXeYkrc0JbhIHfZ3+72M kRErp8r0D58Tp4ddhWDYxv/5p4V+6PE= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-711-WC0DMRLgOE6SSKTHPCzU0A-1; Tue, 24 Mar 2026 11:15:59 -0400 X-MC-Unique: WC0DMRLgOE6SSKTHPCzU0A-1 X-Mimecast-MFC-AGG-ID: WC0DMRLgOE6SSKTHPCzU0A_1774365359 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-485c45885e6so59102125e9.0 for ; Tue, 24 Mar 2026 08:15:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1774365358; x=1774970158; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=zZaZ+weNFt/DeQ+y853Qd9D2vVvyy8X2coFZA5Jbyn4=; b=cTiqyWVXW6ThVGdsO/WivvYGEgD6vRr7fw2tex9trBb2cD0cjZKTxMvfrGnfsgqqTK /VKFxciS1+PIN2pALJ/ziWHPHTRdfnZpBzArKkQ9NTNNCx2rQV/YSBWux1XMKJscM1Ic 1YOh1lo3hiRKu107RYjOKZ+upuhu9sRLuh6K5EYCkVbxA+PSutogn/8UFnpN9vPm3g5z JpOI3uTeBvxy6aQg6DPyBrBJUSzkCTiIkoTFQvwknPUPJM8rUrwsh3n2vCEz0aXUkTvT LyHiWBdqED0nxjCgfZvE5wyAeRBxq0BhZ5YXK1bt60GQVk+dZDr9CcCSljExBUWlzNzM 610g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774365358; x=1774970158; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=zZaZ+weNFt/DeQ+y853Qd9D2vVvyy8X2coFZA5Jbyn4=; b=lwHstwFVpvY/NaEqtINaekz5mLnYSQ+Bn8VrvPLcjM1qrUSUOgGBMlXKyDE7VDnnGf eXwYk1JdySpIQ7+uN9AaikczthpNIUWT7T1Bn9LFgeet7j34f43bLdqyXl97RrWIGu7a 1gWbDEc9drasybTfijLZGSmnILVrdMl5ergd2KbF1nm1RH+X1Is+iR2tlh9+S2F80CpT nXl5E0lL7hnHpIsBCSxu7HPiudny1a5dePqay82wfWyjIuI2wKyp+j8W7dp0e4kn0Fh/ VwBuFbfZpr9jpdCTVQXot09IF/Nn8SBbC75sa0ezaPqEeGm/qEpZrD2uKtPH91ZDe4aq 00YQ== X-Gm-Message-State: AOJu0YwuthpBL2kVEo5Vzt4eK3GF9TOC9tvTa4g/1NQnWkN+3XXrxlig uiqMIL0FwtAnNNu2r0+ijgV1a5PoHAeTrUGv6AT4thdBISg9uj/nvjreBoio82tFA5OFmVO5khM yEai8+8O2DqpPeE52nDITQ8+lUMhYZTQ7QunIq9hMBx5UwoJ6djbodspuHrkvsMZiwJ62wZU8Yh 4/bSrASabJr/hFDi2jd6dNAhbZDu2F0w4vgOF5671vm5k= X-Gm-Gg: ATEYQzwuFTMzvMkZAY4OivwLuPMYK2Eet8pay5Zc3/vHz4y61n+/mSSnRTBPQNAnkrf tIUcSZOY7C96Rbr4Sv/D6UV5yBALcAI++7I/kqhB4iA8RRMnlXCMntDQzpgr2OwlNOJvX4VniVA bEc+yxsPWsAiTs9CNF5M7WUB4StHqkULS/15Oce6Uq2y+ca3tg9Y5l8hY4KMImkR2H6hdafYbEH GKrGuYyxAEwql7VHIhRPjd3bJkn+uVWUgOL656RhKQ76nU7iip2N8jtPazr3OdVufNzdrnnEj1T gwXyRKA8K6ucNI2yb9rdhOEhjRBhXqmRRAp3ZreTRWEvyAZD6eW0FYU9vey0w+KDjkGDAvCWSBM uxVroZgPYCkMkLp8U X-Received: by 2002:a05:600c:5296:b0:486:ffa3:593 with SMTP id 5b1f17b1804b1-4871606730amr1910615e9.28.1774365358177; Tue, 24 Mar 2026 08:15:58 -0700 (PDT) X-Received: by 2002:a05:600c:5296:b0:486:ffa3:593 with SMTP id 5b1f17b1804b1-4871606730amr1909895e9.28.1774365357596; Tue, 24 Mar 2026 08:15:57 -0700 (PDT) Received: from redhat.com ([2a0d:6fc0:1525:da00:3ac2:1a22:72ff:4256]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-487116d82f1sm55500765e9.11.2026.03.24.08.15.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 24 Mar 2026 08:15:57 -0700 (PDT) Date: Tue, 24 Mar 2026 11:15:54 -0400 From: "Michael S. Tsirkin" To: linux-kernel@vger.kernel.org Cc: Omar Elghoul , Srikanth Aithal , Jason Wang , Xuan Zhuo , Eugenio =?utf-8?B?UMOpcmV6?= , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Stanislav Fomichev , Vishwanath Seshagiri , netdev@vger.kernel.org, virtualization@lists.linux.dev, bpf@vger.kernel.org Subject: [PATCH net-next] virtio_net: sync RX buffer before reading the header Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email 2.27.0.106.g8ac3dc51b1 X-Mutt-Fcc: =sent Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" receive_buf() reads the virtio header through buf before page_pool_dma_sync_for_cpu() runs in receive_small() or receive_mergeable(). The header buffer is thus unsynchronized at the point where flags and, for mergeable buffers, num_buffers are consumed. Omar Elghoul reported that on s390x Secure Execution this showed up as greatly reduced virtio-net performance together with "bad gso" and "bad csum" messages in dmesg. This is because with SE sync actually copies data, so the header is uninitialized. Move the sync into receive_buf() so the header is synchronized before any access through buf. Tool use: Cursor with GPT-5.4 drafted the initial code move from prompt: "in drivers/net/virtio_net.c, move page_pool_dma_sync_for_cpu on receive path to before memory is accessed through buf". The result and the commit log were reviewed and edited manually. Fixes: 168b61da6871 ("virtio_net: add page_pool support for buffer allocati= on") Reported-by: Omar Elghoul Tested-by: Srikanth Aithal Tested-by: Omar Elghoul Link: https://lore.kernel.org/r/20260323150136.14452-1-oelghoul@linux.ibm.c= om Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Tested-by: Vishwanath Seshagiri --- drivers/net/virtio_net.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 97035b49bae7..2f57245c682d 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -1956,13 +1956,6 @@ static struct sk_buff *receive_small(struct net_devi= ce *dev, */ buf -=3D VIRTNET_RX_PAD + xdp_headroom; =20 - if (rq->use_page_pool_dma) { - int offset =3D buf - page_address(page) + - VIRTNET_RX_PAD + xdp_headroom; - - page_pool_dma_sync_for_cpu(rq->page_pool, page, offset, len); - } - len -=3D vi->hdr_len; u64_stats_add(&stats->bytes, len); =20 @@ -2398,9 +2391,6 @@ static struct sk_buff *receive_mergeable(struct net_d= evice *dev, =20 head_skb =3D NULL; =20 - if (rq->use_page_pool_dma) - page_pool_dma_sync_for_cpu(rq->page_pool, page, offset, len); - u64_stats_add(&stats->bytes, len - vi->hdr_len); =20 if (check_mergeable_len(dev, ctx, len)) @@ -2563,6 +2553,16 @@ static void receive_buf(struct virtnet_info *vi, str= uct receive_queue *rq, return; } =20 + /* Sync the memory before touching anything through buf, + * unless virtio core did it already. + */ + if (rq->use_page_pool_dma) { + struct page *page =3D virt_to_head_page(buf); + int offset =3D buf - page_address(page); + + page_pool_dma_sync_for_cpu(rq->page_pool, page, offset, len); + } + /* About the flags below: * 1. Save the flags early, as the XDP program might overwrite them. * These flags ensure packets marked as VIRTIO_NET_HDR_F_DATA_VALID --=20 MST