[PATCH v2 0/2] Fix minimum frame size checks in vhost-user paths

[PATCH v2 0/2] Fix minimum frame size checks in vhost-user paths

[Laurent Vivier]

In the vhost-user code paths, buffers from the virtio queue include
a virtio net header prepended to the Ethernet frame.  The minimum
frame size checks (ETH_ZLEN, i.e. 60 bytes per IEEE 802.3) must
account for this extra header, otherwise the size requested from
vu_collect() and validated in ASSERT() is too small.

v2:
  - PATCH 1/2 is merged, rebase the series on top of master
  - Add a patch to remove VNET_HLEN from l2len in vu_pad() callers
  - Remove assert on ETH_ZLEN in tcp_vu_prepare() as the size is
    trimmed to the actual data size

Laurent Vivier (2):
  tcp_vu: vu_pad() expects l2 length
  tcp_vu, udp_vu: Account for virtio net header in minimum frame size

 tcp_vu.c | 17 ++++++++++-------
 udp_vu.c |  2 +-
 2 files changed, 11 insertions(+), 8 deletions(-)

-- 
2.53.0

[PATCH v2 1/2] tcp_vu: vu_pad() expects l2 length

[Laurent Vivier]

tcp_vu_hdrlen() returns a length that includes VNET_HLEN (the virtio
net header), but vu_pad() expects the Layer-2 frame length, which
should not include the virtio header. Passing the inflated length
means short frames aren't padded to the minimum 60-byte Ethernet
frame size (ETH_ZLEN).

Subtract VNET_HLEN from hdrlen when computing the l2 length passed
to vu_pad() in both tcp_vu_send_flag() and tcp_vu_data_from_sock().

Fixes: 0cb8f9003654 ("tcp, udp: Pad batched frames for vhost-user modes to 60 bytes (802.3 minimum)")
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
---
 tcp_vu.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tcp_vu.c b/tcp_vu.c
index 3847a4e92087..2c9ddba0c9a4 100644
--- a/tcp_vu.c
+++ b/tcp_vu.c
@@ -71,8 +71,8 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags)
 {
 	struct vu_dev *vdev = c->vdev;
 	struct vu_virtq *vq = &vdev->vq[VHOST_USER_RX_QUEUE];
-	size_t optlen, hdrlen;
 	struct vu_virtq_element flags_elem[2];
+	size_t optlen, hdrlen, l2len;
 	struct ipv6hdr *ip6h = NULL;
 	struct iphdr *ip4h = NULL;
 	struct iovec flags_iov[2];
@@ -137,7 +137,8 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags)
 	tcp_fill_headers(c, conn, eh, ip4h, ip6h, th, &payload,
 			 NULL, seq, !*c->pcap);
 
-	vu_pad(&flags_elem[0].in_sg[0], hdrlen + optlen);
+	l2len = optlen + hdrlen - VNET_HLEN;
+	vu_pad(&flags_elem[0].in_sg[0], l2len);
 
 	if (*c->pcap)
 		pcap_iov(&flags_elem[0].in_sg[0], 1, VNET_HLEN);
@@ -446,6 +447,7 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn)
 		int buf_cnt = head[i + 1] - head[i];
 		ssize_t dlen = iov_size(iov, buf_cnt) - hdrlen;
 		bool push = i == head_cnt - 1;
+		size_t l2len;
 
 		vu_set_vnethdr(vdev, iov->iov_base, buf_cnt);
 
@@ -457,7 +459,8 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn)
 		tcp_vu_prepare(c, conn, iov, buf_cnt, &check, !*c->pcap, push);
 
 		/* Pad first/single buffer only, it's at least ETH_ZLEN long */
-		vu_pad(iov, dlen + hdrlen);
+		l2len = dlen + hdrlen - VNET_HLEN;
+		vu_pad(iov, l2len);
 
 		if (*c->pcap)
 			pcap_iov(iov, buf_cnt, VNET_HLEN);
-- 
2.53.0

[PATCH v2 2/2] tcp_vu, udp_vu: Account for virtio net header in minimum frame size

[Laurent Vivier]

In the vhost-user paths, the buffers provided by the virtio queue
include the virtio net header (VNET_HLEN) prepended to the Ethernet
frame. The minimum size checks using ETH_ZLEN must therefore account
for this additional header length, otherwise we underestimate the
minimum buffer size needed.

Use ETH_ZLEN + VNET_HLEN instead of bare ETH_ZLEN in vu_collect()
calls and the corresponding ASSERT() checks.

In tcp_vu_prepare(), revert the ASSERT to just check for hdrlen,
because at that point iov[0].iov_len has been trimmed to the actual
received data size plus headers.

Fixes: 0cb8f9003654 ("tcp, udp: Pad batched frames for vhost-user modes to 60 bytes (802.3 minimum)")
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
---
 tcp_vu.c | 8 ++++----
 udp_vu.c | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/tcp_vu.c b/tcp_vu.c
index 2c9ddba0c9a4..94169c21f700 100644
--- a/tcp_vu.c
+++ b/tcp_vu.c
@@ -90,12 +90,12 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags)
 	vu_set_element(&flags_elem[0], NULL, &flags_iov[0]);
 
 	elem_cnt = vu_collect(vdev, vq, &flags_elem[0], 1,
-			      MAX(hdrlen + sizeof(*opts), ETH_ZLEN), NULL);
+			      MAX(hdrlen + sizeof(*opts), ETH_ZLEN + VNET_HLEN), NULL);
 	if (elem_cnt != 1)
 		return -1;
 
 	ASSERT(flags_elem[0].in_sg[0].iov_len >=
-	       MAX(hdrlen + sizeof(*opts), ETH_ZLEN));
+	       MAX(hdrlen + sizeof(*opts), ETH_ZLEN + VNET_HLEN));
 
 	vu_set_vnethdr(vdev, flags_elem[0].in_sg[0].iov_base, 1);
 
@@ -209,7 +209,7 @@ static ssize_t tcp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq,
 
 		cnt = vu_collect(vdev, vq, &elem[elem_cnt],
 				 VIRTQUEUE_MAX_SIZE - elem_cnt,
-				 MAX(MIN(mss, fillsize) + hdrlen, ETH_ZLEN),
+				 MAX(MIN(mss, fillsize) + hdrlen, ETH_ZLEN + VNET_HLEN),
 				 &frame_size);
 		if (cnt == 0)
 			break;
@@ -303,7 +303,7 @@ static void tcp_vu_prepare(const struct ctx *c, struct tcp_tap_conn *conn,
 	/* we guess the first iovec provided by the guest can embed
 	 * all the headers needed by L2 frame, including any padding
 	 */
-	ASSERT(iov[0].iov_len >= MAX(hdrlen, ETH_ZLEN));
+	ASSERT(iov[0].iov_len >= hdrlen);
 
 	eh = vu_eth(base);
 
diff --git a/udp_vu.c b/udp_vu.c
index 4f1eac48d162..d190fef82d49 100644
--- a/udp_vu.c
+++ b/udp_vu.c
@@ -97,7 +97,7 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s,
 		return -1;
 
 	/* reserve space for the headers */
-	ASSERT(iov_vu[0].iov_len >= MAX(hdrlen, ETH_ZLEN));
+	ASSERT(iov_vu[0].iov_len >= MAX(hdrlen, ETH_ZLEN + VNET_HLEN));
 	iov_vu[0].iov_base = (char *)iov_vu[0].iov_base + hdrlen;
 	iov_vu[0].iov_len -= hdrlen;
 
-- 
2.53.0