Commit c9cbbe7a authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge branch 'virtio-net-fixes-for-mergeable-xdp-receive-path' 

Bui Quang Minh says:

====================
virtio-net: fixes for mergeable XDP receive path

This series contains fixes for XDP receive path in virtio-net
- Patch 1: add a missing check for the received data length with our
allocated buffer size in mergeable mode.
- Patch 2: remove a redundant truesize check with PAGE_SIZE in mergeable
mode
- Patch 3: make the current repeated code use the check_mergeable_len to
check for received data length in mergeable mode
====================

Link: https://patch.msgid.link/20250630144212.48471-1-minhquangbui99@gmail.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents bd475eea 7d4a119e

drivers/net/virtio_net.c

+42 −33
Original line number Diff line number Diff line
@@ -778,6 +778,26 @@ static unsigned int mergeable_ctx_to_truesize(void *mrg_ctx) 
	return (unsigned long)mrg_ctx & ((1 << MRG_CTX_HEADER_SHIFT) - 1);

}



static int check_mergeable_len(struct net_device *dev, void *mrg_ctx,

			       unsigned int len)

{

	unsigned int headroom, tailroom, room, truesize;



	truesize = mergeable_ctx_to_truesize(mrg_ctx);

	headroom = mergeable_ctx_to_headroom(mrg_ctx);

	tailroom = headroom ? sizeof(struct skb_shared_info) : 0;

	room = SKB_DATA_ALIGN(headroom + tailroom);



	if (len > truesize - room) {

		pr_debug("%s: rx error: len %u exceeds truesize %lu\n",

			 dev->name, len, (unsigned long)(truesize - room));

		DEV_STATS_INC(dev, rx_length_errors);

		return -1;

	}



	return 0;

}



static struct sk_buff *virtnet_build_skb(void *buf, unsigned int buflen,

					 unsigned int headroom,

					 unsigned int len)
@@ -1797,7 +1817,8 @@ static unsigned int virtnet_get_headroom(struct virtnet_info *vi) 
 * across multiple buffers (num_buf > 1), and we make sure buffers

 * have enough headroom.

 */

static struct page *xdp_linearize_page(struct receive_queue *rq,

static struct page *xdp_linearize_page(struct net_device *dev,

				       struct receive_queue *rq,

				       int *num_buf,

				       struct page *p,

				       int offset,
@@ -1817,18 +1838,27 @@ static struct page *xdp_linearize_page(struct receive_queue *rq, 
	memcpy(page_address(page) + page_off, page_address(p) + offset, *len);

	page_off += *len;



	/* Only mergeable mode can go inside this while loop. In small mode,

	 * *num_buf == 1, so it cannot go inside.

	 */

	while (--*num_buf) {

		unsigned int buflen;

		void *buf;

		void *ctx;

		int off;



		buf = virtnet_rq_get_buf(rq, &buflen, NULL);

		buf = virtnet_rq_get_buf(rq, &buflen, &ctx);

		if (unlikely(!buf))

			goto err_buf;



		p = virt_to_head_page(buf);

		off = buf - page_address(p);



		if (check_mergeable_len(dev, ctx, buflen)) {

			put_page(p);

			goto err_buf;

		}



		/* guard against a misconfigured or uncooperative backend that

		 * is sending packet larger than the MTU.

		 */
@@ -1917,7 +1947,7 @@ static struct sk_buff *receive_small_xdp(struct net_device *dev, 
		headroom = vi->hdr_len + header_offset;

		buflen = SKB_DATA_ALIGN(GOOD_PACKET_LEN + headroom) +

			SKB_DATA_ALIGN(sizeof(struct skb_shared_info));

		xdp_page = xdp_linearize_page(rq, &num_buf, page,

		xdp_page = xdp_linearize_page(dev, rq, &num_buf, page,

					      offset, header_offset,

					      &tlen);

		if (!xdp_page)
@@ -2126,10 +2156,9 @@ static int virtnet_build_xdp_buff_mrg(struct net_device *dev, 
				      struct virtnet_rq_stats *stats)

{

	struct virtio_net_hdr_mrg_rxbuf *hdr = buf;

	unsigned int headroom, tailroom, room;

	unsigned int truesize, cur_frag_size;

	struct skb_shared_info *shinfo;

	unsigned int xdp_frags_truesz = 0;

	unsigned int truesize;

	struct page *page;

	skb_frag_t *frag;

	int offset;
@@ -2172,21 +2201,14 @@ static int virtnet_build_xdp_buff_mrg(struct net_device *dev, 
		page = virt_to_head_page(buf);

		offset = buf - page_address(page);



		truesize = mergeable_ctx_to_truesize(ctx);

		headroom = mergeable_ctx_to_headroom(ctx);

		tailroom = headroom ? sizeof(struct skb_shared_info) : 0;

		room = SKB_DATA_ALIGN(headroom + tailroom);



		cur_frag_size = truesize;

		xdp_frags_truesz += cur_frag_size;

		if (unlikely(len > truesize - room || cur_frag_size > PAGE_SIZE)) {

		if (check_mergeable_len(dev, ctx, len)) {

			put_page(page);

			pr_debug("%s: rx error: len %u exceeds truesize %lu\n",

				 dev->name, len, (unsigned long)(truesize - room));

			DEV_STATS_INC(dev, rx_length_errors);

			goto err;

		}



		truesize = mergeable_ctx_to_truesize(ctx);

		xdp_frags_truesz += truesize;



		frag = &shinfo->frags[shinfo->nr_frags++];

		skb_frag_fill_page_desc(frag, page, offset, len);

		if (page_is_pfmemalloc(page))
@@ -2252,7 +2274,7 @@ static void *mergeable_xdp_get_buf(struct virtnet_info *vi, 
	 */

	if (!xdp_prog->aux->xdp_has_frags) {

		/* linearize data for XDP */

		xdp_page = xdp_linearize_page(rq, num_buf,

		xdp_page = xdp_linearize_page(vi->dev, rq, num_buf,

					      *page, offset,

					      XDP_PACKET_HEADROOM,

					      len);
@@ -2400,18 +2422,12 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, 
	struct sk_buff *head_skb, *curr_skb;

	unsigned int truesize = mergeable_ctx_to_truesize(ctx);

	unsigned int headroom = mergeable_ctx_to_headroom(ctx);

	unsigned int tailroom = headroom ? sizeof(struct skb_shared_info) : 0;

	unsigned int room = SKB_DATA_ALIGN(headroom + tailroom);



	head_skb = NULL;

	u64_stats_add(&stats->bytes, len - vi->hdr_len);



	if (unlikely(len > truesize - room)) {

		pr_debug("%s: rx error: len %u exceeds truesize %lu\n",

			 dev->name, len, (unsigned long)(truesize - room));

		DEV_STATS_INC(dev, rx_length_errors);

	if (check_mergeable_len(dev, ctx, len))

		goto err_skb;

	}



	if (unlikely(vi->xdp_enabled)) {

		struct bpf_prog *xdp_prog;
@@ -2446,17 +2462,10 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, 
		u64_stats_add(&stats->bytes, len);

		page = virt_to_head_page(buf);



		truesize = mergeable_ctx_to_truesize(ctx);

		headroom = mergeable_ctx_to_headroom(ctx);

		tailroom = headroom ? sizeof(struct skb_shared_info) : 0;

		room = SKB_DATA_ALIGN(headroom + tailroom);

		if (unlikely(len > truesize - room)) {

			pr_debug("%s: rx error: len %u exceeds truesize %lu\n",

				 dev->name, len, (unsigned long)(truesize - room));

			DEV_STATS_INC(dev, rx_length_errors);

		if (check_mergeable_len(dev, ctx, len))

			goto err_skb;

		}



		truesize = mergeable_ctx_to_truesize(ctx);

		curr_skb  = virtnet_skb_append_frag(head_skb, curr_skb, page,

						    buf, len, truesize);

		if (!curr_skb)