[PATCH] net/vhost: preserve Tx ownership on VLAN failure

[Weijun Pan <wpan3636@gmail.com>]

The Tx path compacts the input mbuf array after software VLAN
insertion fails. Later packets are moved into the failed packet's
slot while the failed mbuf is freed.

The returned count then no longer identifies a prefix of the original
burst. An application freeing the unsent suffix can therefore free
duplicate or stale mbuf pointers.

Stop preprocessing at the first VLAN insertion failure and leave the
failed mbuf and the remaining suffix owned by the caller. Count only
packets prepared for vhost enqueue but not accepted as missed.

Bugzilla ID: 1884
Fixes: f63d356ee993 ("net/vhost: insert/strip VLAN header in software")
Cc: stable@dpdk.org

Signed-off-by: Weijun Pan <wpan3636@gmail.com>
---
Cc: Jan Blunck <jblunck@infradead.org>

Tested:
- Full x86_64 debug build with AddressSanitizer.
- Two-process net_vhost and virtio-user data-path test.
- Forced VLAN insertion failure on packet 1 by removing its headroom.
- rte_eth_tx_burst() returned 1 and preserved the unsent suffix.
- testpmd received 1 packet with no RX errors or missed packets.

 drivers/net/vhost/rte_eth_vhost.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/net/vhost/rte_eth_vhost.c b/drivers/net/vhost/rte_eth_vhost.c
index 05940f2461..9a85f1e26d 100644
--- a/drivers/net/vhost/rte_eth_vhost.c
+++ b/drivers/net/vhost/rte_eth_vhost.c
@@ -474,19 +474,17 @@ eth_vhost_tx(void *q, struct rte_mbuf **bufs, uint16_t nb_bufs)
 		/* Do VLAN tag insertion */
 		if (m->ol_flags & RTE_MBUF_F_TX_VLAN) {
 			int error = rte_vlan_insert(&m);
-			if (unlikely(error)) {
-				rte_pktmbuf_free(m);
-				continue;
-			}
+
+			if (unlikely(error))
+				break;
 		}
 
 		if (r->internal->tx_sw_csum)
 			vhost_dev_tx_sw_csum(m);
 
-
-		bufs[nb_send] = m;
-		++nb_send;
+		bufs[i] = m;
 	}
+	nb_send = i;
 
 	/* Enqueue packets to guest RX queue */
 	while (nb_send) {
@@ -506,7 +504,7 @@ eth_vhost_tx(void *q, struct rte_mbuf **bufs, uint16_t nb_bufs)
 	for (i = 0; likely(i < nb_tx); i++)
 		nb_bytes += bufs[i]->pkt_len;
 
-	nb_missed = nb_bufs - nb_tx;
+	nb_missed = nb_send;
 
 	r->stats.pkts += nb_tx;
 	r->stats.bytes += nb_bytes;
-- 
2.34.1