summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSteven Luong <sluong@cisco.com>2019-10-23 13:28:37 -0700
committersteven luong <sluong@cisco.com>2019-10-25 16:54:06 +0000
commite6329ada4401f4a7e418a48fe829bbc211e28b6f (patch)
tree25bc07cfe38845d1fe267c26f22a853b99c12f52
parent9ad27550b54ee65648487b6405bb61925ccd3397 (diff)
devices: vhoost cpu->copy array overflow on tcp jumbo frame (65535 bytes)
We reserve 40 slots in cpu->copy array prior to copy out to avoid overflowing the array. However, 40 is not enough for the jumbo frame because desceiptor buffer len is likely at 1536. Change the reserve to 200 and add ASSERT to avoid encountering the same problem in the future. Type: fix Signed-off-by: Steven Luong <sluong@cisco.com> Change-Id: Ibf0c03c4b4f33e781d5be8679ccd6c3a4b4a646d (cherry picked from commit 7331005c16d0e1499080899b2a0676a0cd945595)
-rw-r--r--src/vnet/devices/virtio/vhost_user_input.c1
-rw-r--r--src/vnet/devices/virtio/vhost_user_output.c9
2 files changed, 8 insertions, 2 deletions
diff --git a/src/vnet/devices/virtio/vhost_user_input.c b/src/vnet/devices/virtio/vhost_user_input.c
index 79c66eecd90..2124ecd499f 100644
--- a/src/vnet/devices/virtio/vhost_user_input.c
+++ b/src/vnet/devices/virtio/vhost_user_input.c
@@ -532,6 +532,7 @@ vhost_user_if_input (vlib_main_t * vm,
}
/* Prepare a copy order executed later for the data */
+ ASSERT (copy_len < VHOST_USER_COPY_ARRAY_N);
vhost_copy_t *cpy = &cpu->copy[copy_len];
copy_len++;
u32 desc_data_l = desc_table[desc_current].len - desc_data_offset;
diff --git a/src/vnet/devices/virtio/vhost_user_output.c b/src/vnet/devices/virtio/vhost_user_output.c
index c0c54d1b13a..de34a3a86b0 100644
--- a/src/vnet/devices/virtio/vhost_user_output.c
+++ b/src/vnet/devices/virtio/vhost_user_output.c
@@ -49,9 +49,12 @@
* entries. In order to not corrupt memory, we have to do the copy when the
* static array reaches the copy threshold. We subtract 40 in case the code
* goes into the inner loop for a maximum of 64k frames which may require
- * more array entries.
+ * more array entries. We subtract 200 because our default buffer size is
+ * 2048 and the default desc len is likely 1536. While it takes less than 40
+ * vlib buffers for the jumbo frame, it may take twice as much descriptors
+ * for the same jumbo frame. Use 200 for the extra head room.
*/
-#define VHOST_USER_TX_COPY_THRESHOLD (VHOST_USER_COPY_ARRAY_N - 40)
+#define VHOST_USER_TX_COPY_THRESHOLD (VHOST_USER_COPY_ARRAY_N - 200)
extern vnet_device_class_t vhost_user_device_class;
@@ -339,6 +342,7 @@ retry:
hdr->num_buffers = 1; //This is local, no need to check
// Prepare a copy order executed later for the header
+ ASSERT (copy_len < VHOST_USER_COPY_ARRAY_N);
vhost_copy_t *cpy = &cpu->copy[copy_len];
copy_len++;
cpy->len = vui->virtio_net_hdr_sz;
@@ -426,6 +430,7 @@ retry:
}
{
+ ASSERT (copy_len < VHOST_USER_COPY_ARRAY_N);
vhost_copy_t *cpy = &cpu->copy[copy_len];
copy_len++;
cpy->len = bytes_left;