Re: [PATCH net-next v5 7/9] vhost-net: support VIRTIO_NET_F_RX_TSTAMP

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] vhost-net: descriptor leak on vnet_hdr copy failure in
  handle_rx() [1]
--

commit 454489b63f879c752d31f70af8fbc748e0db8e54
Author: Steffen Trumtrar <s.trumtrar@pengutronix.de>

vhost-net: support VIRTIO_NET_F_RX_TSTAMP

This commit advertises VIRTIO_NET_F_RX_TSTAMP to userspace, sizes the
virtio-net header to include the receive timestamp field when negotiated,
and zeroes the remaining header bytes in handle_rx() when vhost supplies
the header.

> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 435d8ed3851f3..1b171af105a22 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c

[ ... ]

> @@ -1278,6 +1283,16 @@ static void handle_rx(struct vhost_net *net)
>  			vhost_discard_vq_desc(vq, headcount, ndesc);
>  			goto out;
>  		}
> +		/* Zero the rest of a header supplied by vhost, e.g. tstamp */
> +		if (unlikely(vhost_hlen > hdr_filled)) {
> +			size_t rest = vhost_hlen - hdr_filled;
> +
> +			if (iov_iter_zero(rest, &fixup) != rest) {
> +				vq_err(vq, "Failed vnet_hdr zeroing");
> +				vhost_discard_vq_desc(vq, headcount, ndesc);
> +				goto out;
> +			}
> +		}

[Severity: Medium]
This problem wasn't introduced by this patch, but does the error path
just above this hunk leak RX descriptors [1] when copying hdr fails?

drivers/vhost/net.c:handle_rx() {
	...
		if (unlikely(vhost_hlen)) {
			if (copy_to_iter(&hdr, sizeof(hdr),
					 &fixup) != sizeof(hdr)) {
				vq_err(vq, "Unable to write vnet_hdr "
				       "at addr %p\n", vq->iov->iov_base);
				goto out;
			}
	...
}

Unlike the num_buffers and iov_iter_zero() failure paths, jumping to out
there skips vhost_discard_vq_desc(vq, headcount, ndesc), so the
descriptors consumed by get_rx_bufs() are neither rolled back nor
signalled as used.

[1] https://sashiko.dev/#/bug/linux-a8cbb3ff-e3eb-42fc-9cbf-3422af552e28

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-v6-7-topic-virtio-net-ptp-v5-0-7ab67b572f4f@pengutronix.de?part=7