On Sun, Dec 27, 2020 at 6:26 AM Michael S. Tsirkin <mst@xxxxxxxxxx> wrote:
>
> On Fri, Dec 25, 2020 at 03:24:25PM +0800, wangyunjian wrote:
> > From: Yunjian Wang <wangyunjian@xxxxxxxxxx>
> >
> > Currently the vhost_zerocopy_callback() maybe be called to decrease
> > the refcount when sendmsg fails in tun. The error handling in vhost
> > handle_tx_zerocopy() will try to decrease the same refcount again.
> > This is wrong. To fix this issue, we only call vhost_net_ubuf_put()
> > when vq->heads[nvq->desc].len == VHOST_DMA_IN_PROGRESS.
> >
> > Fixes: 0690899b4d45 ("tun: experimental zero copy tx support")
>
> Are you sure about this tag? the patch in question only affects
> tun, while the fix only affects vhost.
That was my suggestion. But you're right. Perhaps better:
Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")
That introduces the actual block that releases the buffer on error:
"
err = sock->ops->sendmsg(NULL, sock, &msg, len);
if (unlikely(err < 0)) {
+ if (zcopy) {
+ if (ubufs)
+ vhost_ubuf_put(ubufs);
+ vq->upend_idx = ((unsigned)vq->upend_idx - 1) %
+ UIO_MAXIOV;
+ }
"
_______________________________________________
Virtualization mailing list
Virtualization@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
