[dpdk-stable] patch 'vhost: fix mbuf free' has been queued to LTS release 16.11.5

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to LTS release 16.11.5

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 01/28/18. So please
shout if anyone has objections.

Thanks.

Luca Boccassi

---
>From 57abdf63ae7623eaa169729547d0d0336f49695c Mon Sep 17 00:00:00 2001
From: Junjie Chen <junjie.j.chen at intel.com>
Date: Wed, 17 Jan 2018 10:45:53 -0500
Subject: [PATCH] vhost: fix mbuf free

[ upstream commit 3ebd930588b7847906e08e2645a35761a90abf2a ]

dequeue zero copy change buf_addr and buf_iova of mbuf, and return
to mbuf pool without restore them, it breaks vm memory if others allocate
mbuf from same pool since mbuf reset doesn't reset buf_addr and buf_iova.

Fixes: b0a985d1f340 ("vhost: add dequeue zero copy")

Signed-off-by: Junjie Chen <junjie.j.chen at intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin at redhat.com>
Acked-by: Yuanhan Liu <yliu at fridaylinux.org>
---
 lib/librte_vhost/virtio_net.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
index 83a0082e5..db194507e 100644
--- a/lib/librte_vhost/virtio_net.c
+++ b/lib/librte_vhost/virtio_net.c
@@ -1028,6 +1028,22 @@ mbuf_is_consumed(struct rte_mbuf *m)
 	return true;
 }
 
+static inline void __attribute__((always_inline))
+restore_mbuf(struct rte_mbuf *m)
+{
+	uint32_t mbuf_size, priv_size;
+
+	while (m) {
+		priv_size = rte_pktmbuf_priv_size(m->pool);
+		mbuf_size = sizeof(struct rte_mbuf) + priv_size;
+		/* start of buffer is after mbuf structure and priv data */
+
+		m->buf_addr = (char *)m + mbuf_size;
+		m->buf_physaddr = rte_mempool_virt2phy(NULL, m) + mbuf_size;
+		m = m->next;
+	}
+}
+
 uint16_t
 rte_vhost_dequeue_burst(int vid, uint16_t queue_id,
 	struct rte_mempool *mbuf_pool, struct rte_mbuf **pkts, uint16_t count)
@@ -1070,6 +1086,7 @@ rte_vhost_dequeue_burst(int vid, uint16_t queue_id,
 				nr_updated += 1;
 
 				TAILQ_REMOVE(&vq->zmbuf_list, zmbuf, next);
+				restore_mbuf(zmbuf->mbuf);
 				rte_pktmbuf_free(zmbuf->mbuf);
 				put_zmbuf(zmbuf);
 				vq->nr_zmbuf -= 1;
-- 
2.14.2