From: luffyluo
With vhost-user a guest frame can span several descriptors. The pool
stores such a packet as a marker slot (iov_base == NULL, iov_len = N)
followed by N data slots, and packet_get() uses the marker to return
all N iovecs at once.
The traversal loops in tap4_handler(), tap6_handler(),
tcp_data_from_tap() and udp_tap_handler() don't know about markers and
advance one slot at a time: after handling the packet from its marker
they land on its first data slot, where iov_base != NULL, so
packet_get() hands back that slot alone, as if it were a whole
single-iovec packet. Parsing that fragment as a complete frame is
what breaks: in tcp_data_from_tap() a fragment shorter than a TCP
header makes IOV_PEEK_HEADER() fail ("TCP header not contiguous"), and
a longer one gives a th->doff read from payload bytes, so
off = th->doff * 4 exceeds the fragment length. In udp_tap_handler()
the fragments go out as extra datagrams.
Fix it with packet_next(), returning the index of the packet following
the one at a given index, and use it to advance those loops, so they
skip the data slots of the packet they just handled. For single-iovec
packets it returns idx + 1, so tap and pasta, which always build
single-iovec tails with IOV_TAIL_FROM_BUF(), are unaffected.
Fixes: ca38be0141d1 ("packet: Add support for multi-vector packets")
Signed-off-by: luffyluo
---
packet.c | 16 ++++++++++++++++
packet.h | 1 +
tap.c | 4 ++--
tcp.c | 2 +-
udp.c | 7 +++++--
5 files changed, 25 insertions(+), 5 deletions(-)
diff --git a/packet.c b/packet.c
index 7a347be..f202245 100644
--- a/packet.c
+++ b/packet.c
@@ -207,3 +207,19 @@ void pool_flush(struct pool *p)
{
p->count = 0;
}
+
+/**
+ * packet_next() - Index of the packet following the one at @idx
+ * @p: Packet pool
+ * @idx: Slot index of the current packet (marker or single iovec)
+ *
+ * A multi-iovec packet is stored as a marker slot (iov_base == NULL) whose
+ * iov_len holds the number of iovec slots that follow it. Return the slot
+ * index of the next packet.
+ */
+size_t packet_next(const struct pool *p, size_t idx)
+{
+ if (p->pkt[idx].iov_base == NULL)
+ return idx + p->pkt[idx].iov_len + 1;
+ return idx + 1;
+}
diff --git a/packet.h b/packet.h
index 7b7fa71..03821f6 100644
--- a/packet.h
+++ b/packet.h
@@ -41,6 +41,7 @@ bool packet_get_do(const struct pool *p, const size_t idx,
struct iov_tail *data, const char *func, int line);
bool pool_can_fit(const struct pool *p, struct iov_tail *data);
void pool_flush(struct pool *p);
+size_t packet_next(const struct pool *p, size_t idx);
#define packet_add(p, data) \
packet_add_do(p, data, __func__, __LINE__)
diff --git a/tap.c b/tap.c
index dfa66c7..1a310fe 100644
--- a/tap.c
+++ b/tap.c
@@ -700,7 +700,7 @@ static int tap4_handler(struct ctx *c, const struct pool *in,
i = 0;
resume:
- for (seq_count = 0, seq = NULL; i < in->count; i++) {
+ for (seq_count = 0, seq = NULL; i < in->count; i = packet_next(in, i)) {
struct iovec trim_iov[UIO_MAXIOV];
size_t l3len, hlen, l4len, check;
struct ethhdr eh_storage;
@@ -948,7 +948,7 @@ static int tap6_handler(struct ctx *c, const struct pool *in,
i = 0;
resume:
- for (seq_count = 0, seq = NULL; i < in->count; i++) {
+ for (seq_count = 0, seq = NULL; i < in->count; i = packet_next(in, i)) {
size_t l4len, plen, check;
struct in6_addr *saddr, *daddr;
struct ipv6hdr ip6h_storage;
diff --git a/tcp.c b/tcp.c
index 95f4f3e..a3bb8b9 100644
--- a/tcp.c
+++ b/tcp.c
@@ -1946,7 +1946,7 @@ static int tcp_data_from_tap(const struct ctx *c, struct tcp_tap_conn *conn,
assert(conn->events & ESTABLISHED);
- for (i = idx, iov_i = 0; i < (int)p->count; i++) {
+ for (i = idx, iov_i = 0; i < (int)p->count; i = packet_next(p, i)) {
uint32_t seq, seq_offset, ack_seq;
struct tcphdr th_storage;
const struct tcphdr *th;
diff --git a/udp.c b/udp.c
index 505e554..bd5e241 100644
--- a/udp.c
+++ b/udp.c
@@ -1029,6 +1029,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif,
const struct udphdr *uh;
struct udp_flow *uflow;
int i, j, s, count = 0;
+ size_t slot;
struct iov_tail data;
flow_sidx_t tosidx;
in_port_t src, dst;
@@ -1077,10 +1078,12 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif,
pif_sockaddr(c, &to_sa, topif, &toside->eaddr, toside->eport);
- for (i = 0, j = 0; i < (int)p->count - idx && j < UIO_MAXIOV; i++) {
+ for (i = 0, j = 0, slot = idx;
+ slot < p->count && j < UIO_MAXIOV;
+ slot = packet_next(p, slot), i++) {
const struct udphdr *uh_send;
- if (!packet_get(p, idx + i, &data))
+ if (!packet_get(p, slot, &data))
return p->count - idx;
uh_send = IOV_REMOVE_HEADER(&data, uh_storage);
--
2.43.7