* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-28 17:17 [PATCH net,stable] vhost: fix skb leak in handle_rx() wexu
@ 2017-11-28 17:50 ` Michael S. Tsirkin
2017-11-28 17:53 ` Michael S. Tsirkin
` (3 subsequent siblings)
4 siblings, 0 replies; 16+ messages in thread
From: Michael S. Tsirkin @ 2017-11-28 17:50 UTC (permalink / raw)
To: wexu; +Cc: virtualization, netdev, linux-kernel, jasowang, mjrosato
On Tue, Nov 28, 2017 at 12:17:16PM -0500, wexu@redhat.com wrote:
> From: Wei Xu <wexu@redhat.com>
>
> Matthew found a roughly 40% tcp throughput regression with commit
> c67df11f(vhost_net: try batch dequing from skb array) as discussed
> in the following thread:
> https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
>
> Eventually we figured out that it was a skb leak in handle_rx()
> when sending packets to the VM. This usually happens when a guest
> can not drain out vq as fast as vhost fills in, afterwards it sets
> off the traffic jam and leaks skb(s) which occurs as no headcount
> to send on the vq from vhost side.
>
> This can be avoided by making sure we have got enough headcount
> before actually consuming a skb from the batched rx array while
> transmitting, which is simply done by deferring it a moment later
> in this patch.
>
> Signed-off-by: Wei Xu <wexu@redhat.com>
Looks like a good way to fix it, but it will still leak if recvmsg
returns a wrong length (I'm not sure this can happen in practice, but
best to keep it simple).
Also, we need to add this before each recvmsg, including overrun,
and discard on error.
> ---
> drivers/vhost/net.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 8d626d7..e76535e 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> /* On error, stop handling until the next kick. */
> if (unlikely(headcount < 0))
> goto out;
> - if (nvq->rx_array)
> - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> /* On overrun, truncate and discard */
> if (unlikely(headcount > UIO_MAXIOV)) {
> iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> */
> iov_iter_advance(&msg.msg_iter, vhost_hlen);
> }
> + if (nvq->rx_array)
> + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> err = sock->ops->recvmsg(sock, &msg,
> sock_len, MSG_DONTWAIT | MSG_TRUNC);
> /* Userspace might have consumed the packet meanwhile:
> --
> 1.8.3.1
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
@ 2017-11-28 17:50 ` Michael S. Tsirkin
0 siblings, 0 replies; 16+ messages in thread
From: Michael S. Tsirkin @ 2017-11-28 17:50 UTC (permalink / raw)
To: wexu; +Cc: mjrosato, netdev, linux-kernel, virtualization
On Tue, Nov 28, 2017 at 12:17:16PM -0500, wexu@redhat.com wrote:
> From: Wei Xu <wexu@redhat.com>
>
> Matthew found a roughly 40% tcp throughput regression with commit
> c67df11f(vhost_net: try batch dequing from skb array) as discussed
> in the following thread:
> https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
>
> Eventually we figured out that it was a skb leak in handle_rx()
> when sending packets to the VM. This usually happens when a guest
> can not drain out vq as fast as vhost fills in, afterwards it sets
> off the traffic jam and leaks skb(s) which occurs as no headcount
> to send on the vq from vhost side.
>
> This can be avoided by making sure we have got enough headcount
> before actually consuming a skb from the batched rx array while
> transmitting, which is simply done by deferring it a moment later
> in this patch.
>
> Signed-off-by: Wei Xu <wexu@redhat.com>
Looks like a good way to fix it, but it will still leak if recvmsg
returns a wrong length (I'm not sure this can happen in practice, but
best to keep it simple).
Also, we need to add this before each recvmsg, including overrun,
and discard on error.
> ---
> drivers/vhost/net.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 8d626d7..e76535e 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> /* On error, stop handling until the next kick. */
> if (unlikely(headcount < 0))
> goto out;
> - if (nvq->rx_array)
> - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> /* On overrun, truncate and discard */
> if (unlikely(headcount > UIO_MAXIOV)) {
> iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> */
> iov_iter_advance(&msg.msg_iter, vhost_hlen);
> }
> + if (nvq->rx_array)
> + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> err = sock->ops->recvmsg(sock, &msg,
> sock_len, MSG_DONTWAIT | MSG_TRUNC);
> /* Userspace might have consumed the packet meanwhile:
> --
> 1.8.3.1
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-28 17:50 ` Michael S. Tsirkin
(?)
@ 2017-11-29 6:12 ` Wei Xu
-1 siblings, 0 replies; 16+ messages in thread
From: Wei Xu @ 2017-11-29 6:12 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: virtualization, netdev, linux-kernel, jasowang, mjrosato
On Tue, Nov 28, 2017 at 07:50:58PM +0200, Michael S. Tsirkin wrote:
> On Tue, Nov 28, 2017 at 12:17:16PM -0500, wexu@redhat.com wrote:
> > From: Wei Xu <wexu@redhat.com>
> >
> > Matthew found a roughly 40% tcp throughput regression with commit
> > c67df11f(vhost_net: try batch dequing from skb array) as discussed
> > in the following thread:
> > https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
> >
> > Eventually we figured out that it was a skb leak in handle_rx()
> > when sending packets to the VM. This usually happens when a guest
> > can not drain out vq as fast as vhost fills in, afterwards it sets
> > off the traffic jam and leaks skb(s) which occurs as no headcount
> > to send on the vq from vhost side.
> >
> > This can be avoided by making sure we have got enough headcount
> > before actually consuming a skb from the batched rx array while
> > transmitting, which is simply done by deferring it a moment later
> > in this patch.
> >
> > Signed-off-by: Wei Xu <wexu@redhat.com>
>
> Looks like a good way to fix it, but it will still leak if recvmsg
> returns a wrong length (I'm not sure this can happen in practice, but
> best to keep it simple).
Right, it is better to defend this case, will include it in v2.
>
> Also, we need to add this before each recvmsg, including overrun,
> and discard on error.
OK.
Wei
>
> > ---
> > drivers/vhost/net.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> > index 8d626d7..e76535e 100644
> > --- a/drivers/vhost/net.c
> > +++ b/drivers/vhost/net.c
> > @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> > /* On error, stop handling until the next kick. */
> > if (unlikely(headcount < 0))
> > goto out;
> > - if (nvq->rx_array)
> > - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > /* On overrun, truncate and discard */
> > if (unlikely(headcount > UIO_MAXIOV)) {
> > iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> > @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> > */
> > iov_iter_advance(&msg.msg_iter, vhost_hlen);
> > }
> > + if (nvq->rx_array)
> > + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > err = sock->ops->recvmsg(sock, &msg,
> > sock_len, MSG_DONTWAIT | MSG_TRUNC);
> > /* Userspace might have consumed the packet meanwhile:
> > --
> > 1.8.3.1
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-28 17:50 ` Michael S. Tsirkin
(?)
(?)
@ 2017-11-29 6:12 ` Wei Xu
-1 siblings, 0 replies; 16+ messages in thread
From: Wei Xu @ 2017-11-29 6:12 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: mjrosato, netdev, linux-kernel, virtualization
On Tue, Nov 28, 2017 at 07:50:58PM +0200, Michael S. Tsirkin wrote:
> On Tue, Nov 28, 2017 at 12:17:16PM -0500, wexu@redhat.com wrote:
> > From: Wei Xu <wexu@redhat.com>
> >
> > Matthew found a roughly 40% tcp throughput regression with commit
> > c67df11f(vhost_net: try batch dequing from skb array) as discussed
> > in the following thread:
> > https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
> >
> > Eventually we figured out that it was a skb leak in handle_rx()
> > when sending packets to the VM. This usually happens when a guest
> > can not drain out vq as fast as vhost fills in, afterwards it sets
> > off the traffic jam and leaks skb(s) which occurs as no headcount
> > to send on the vq from vhost side.
> >
> > This can be avoided by making sure we have got enough headcount
> > before actually consuming a skb from the batched rx array while
> > transmitting, which is simply done by deferring it a moment later
> > in this patch.
> >
> > Signed-off-by: Wei Xu <wexu@redhat.com>
>
> Looks like a good way to fix it, but it will still leak if recvmsg
> returns a wrong length (I'm not sure this can happen in practice, but
> best to keep it simple).
Right, it is better to defend this case, will include it in v2.
>
> Also, we need to add this before each recvmsg, including overrun,
> and discard on error.
OK.
Wei
>
> > ---
> > drivers/vhost/net.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> > index 8d626d7..e76535e 100644
> > --- a/drivers/vhost/net.c
> > +++ b/drivers/vhost/net.c
> > @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> > /* On error, stop handling until the next kick. */
> > if (unlikely(headcount < 0))
> > goto out;
> > - if (nvq->rx_array)
> > - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > /* On overrun, truncate and discard */
> > if (unlikely(headcount > UIO_MAXIOV)) {
> > iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> > @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> > */
> > iov_iter_advance(&msg.msg_iter, vhost_hlen);
> > }
> > + if (nvq->rx_array)
> > + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > err = sock->ops->recvmsg(sock, &msg,
> > sock_len, MSG_DONTWAIT | MSG_TRUNC);
> > /* Userspace might have consumed the packet meanwhile:
> > --
> > 1.8.3.1
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-28 17:17 [PATCH net,stable] vhost: fix skb leak in handle_rx() wexu
2017-11-28 17:50 ` Michael S. Tsirkin
@ 2017-11-28 17:53 ` Michael S. Tsirkin
2017-11-28 17:53 ` Michael S. Tsirkin
` (2 subsequent siblings)
4 siblings, 0 replies; 16+ messages in thread
From: Michael S. Tsirkin @ 2017-11-28 17:53 UTC (permalink / raw)
To: wexu; +Cc: mjrosato, netdev, linux-kernel, virtualization
On Tue, Nov 28, 2017 at 12:17:16PM -0500, wexu@redhat.com wrote:
> From: Wei Xu <wexu@redhat.com>
>
> Matthew found a roughly 40% tcp throughput regression with commit
> c67df11f(vhost_net: try batch dequing from skb array) as discussed
> in the following thread:
> https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
>
> Eventually we figured out that it was a skb leak in handle_rx()
> when sending packets to the VM. This usually happens when a guest
> can not drain out vq as fast as vhost fills in, afterwards it sets
> off the traffic jam and leaks skb(s) which occurs as no headcount
> to send on the vq from vhost side.
>
> This can be avoided by making sure we have got enough headcount
> before actually consuming a skb from the batched rx array while
> transmitting, which is simply done by deferring it a moment later
> in this patch.
>
> Signed-off-by: Wei Xu <wexu@redhat.com>
Given the amount of effort Matthew has put into this,
you definitely want
Reported-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
here.
Let's give credit where credit is due.
Thanks a lot Matthew!
> ---
> drivers/vhost/net.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 8d626d7..e76535e 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> /* On error, stop handling until the next kick. */
> if (unlikely(headcount < 0))
> goto out;
> - if (nvq->rx_array)
> - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> /* On overrun, truncate and discard */
> if (unlikely(headcount > UIO_MAXIOV)) {
> iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> */
> iov_iter_advance(&msg.msg_iter, vhost_hlen);
> }
> + if (nvq->rx_array)
> + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> err = sock->ops->recvmsg(sock, &msg,
> sock_len, MSG_DONTWAIT | MSG_TRUNC);
> /* Userspace might have consumed the packet meanwhile:
> --
> 1.8.3.1
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-28 17:17 [PATCH net,stable] vhost: fix skb leak in handle_rx() wexu
2017-11-28 17:50 ` Michael S. Tsirkin
2017-11-28 17:53 ` Michael S. Tsirkin
@ 2017-11-28 17:53 ` Michael S. Tsirkin
2017-11-29 6:32 ` Wei Xu
2017-11-29 6:32 ` Wei Xu
2017-11-29 1:53 ` Jason Wang
2017-11-29 1:53 ` Jason Wang
4 siblings, 2 replies; 16+ messages in thread
From: Michael S. Tsirkin @ 2017-11-28 17:53 UTC (permalink / raw)
To: wexu; +Cc: virtualization, netdev, linux-kernel, jasowang, mjrosato
On Tue, Nov 28, 2017 at 12:17:16PM -0500, wexu@redhat.com wrote:
> From: Wei Xu <wexu@redhat.com>
>
> Matthew found a roughly 40% tcp throughput regression with commit
> c67df11f(vhost_net: try batch dequing from skb array) as discussed
> in the following thread:
> https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
>
> Eventually we figured out that it was a skb leak in handle_rx()
> when sending packets to the VM. This usually happens when a guest
> can not drain out vq as fast as vhost fills in, afterwards it sets
> off the traffic jam and leaks skb(s) which occurs as no headcount
> to send on the vq from vhost side.
>
> This can be avoided by making sure we have got enough headcount
> before actually consuming a skb from the batched rx array while
> transmitting, which is simply done by deferring it a moment later
> in this patch.
>
> Signed-off-by: Wei Xu <wexu@redhat.com>
Given the amount of effort Matthew has put into this,
you definitely want
Reported-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
here.
Let's give credit where credit is due.
Thanks a lot Matthew!
> ---
> drivers/vhost/net.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 8d626d7..e76535e 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> /* On error, stop handling until the next kick. */
> if (unlikely(headcount < 0))
> goto out;
> - if (nvq->rx_array)
> - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> /* On overrun, truncate and discard */
> if (unlikely(headcount > UIO_MAXIOV)) {
> iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> */
> iov_iter_advance(&msg.msg_iter, vhost_hlen);
> }
> + if (nvq->rx_array)
> + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> err = sock->ops->recvmsg(sock, &msg,
> sock_len, MSG_DONTWAIT | MSG_TRUNC);
> /* Userspace might have consumed the packet meanwhile:
> --
> 1.8.3.1
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-28 17:53 ` Michael S. Tsirkin
@ 2017-11-29 6:32 ` Wei Xu
2017-11-29 6:32 ` Wei Xu
1 sibling, 0 replies; 16+ messages in thread
From: Wei Xu @ 2017-11-29 6:32 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: virtualization, netdev, linux-kernel, jasowang, mjrosato
On Tue, Nov 28, 2017 at 07:53:33PM +0200, Michael S. Tsirkin wrote:
> On Tue, Nov 28, 2017 at 12:17:16PM -0500, wexu@redhat.com wrote:
> > From: Wei Xu <wexu@redhat.com>
> >
> > Matthew found a roughly 40% tcp throughput regression with commit
> > c67df11f(vhost_net: try batch dequing from skb array) as discussed
> > in the following thread:
> > https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
> >
> > Eventually we figured out that it was a skb leak in handle_rx()
> > when sending packets to the VM. This usually happens when a guest
> > can not drain out vq as fast as vhost fills in, afterwards it sets
> > off the traffic jam and leaks skb(s) which occurs as no headcount
> > to send on the vq from vhost side.
> >
> > This can be avoided by making sure we have got enough headcount
> > before actually consuming a skb from the batched rx array while
> > transmitting, which is simply done by deferring it a moment later
> > in this patch.
> >
> > Signed-off-by: Wei Xu <wexu@redhat.com>
>
> Given the amount of effort Matthew has put into this,
> you definitely want
>
> Reported-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
>
> here.
>
Absolutely we want that, sorry for missed you here, Matthew. It is more
like you have figured out this issue independently all by yourself with
a wide assortment of extremely quick tests(tools, throughput, slub leak,
etc), and I am happy that I have the opportunity to do the paperwork on
behalf of you.:) Thanks a lot Matthew.
Wei
> Let's give credit where credit is due.
>
> Thanks a lot Matthew!
>
> > ---
> > drivers/vhost/net.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> > index 8d626d7..e76535e 100644
> > --- a/drivers/vhost/net.c
> > +++ b/drivers/vhost/net.c
> > @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> > /* On error, stop handling until the next kick. */
> > if (unlikely(headcount < 0))
> > goto out;
> > - if (nvq->rx_array)
> > - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > /* On overrun, truncate and discard */
> > if (unlikely(headcount > UIO_MAXIOV)) {
> > iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> > @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> > */
> > iov_iter_advance(&msg.msg_iter, vhost_hlen);
> > }
> > + if (nvq->rx_array)
> > + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > err = sock->ops->recvmsg(sock, &msg,
> > sock_len, MSG_DONTWAIT | MSG_TRUNC);
> > /* Userspace might have consumed the packet meanwhile:
> > --
> > 1.8.3.1
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-28 17:53 ` Michael S. Tsirkin
2017-11-29 6:32 ` Wei Xu
@ 2017-11-29 6:32 ` Wei Xu
1 sibling, 0 replies; 16+ messages in thread
From: Wei Xu @ 2017-11-29 6:32 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: mjrosato, netdev, linux-kernel, virtualization
On Tue, Nov 28, 2017 at 07:53:33PM +0200, Michael S. Tsirkin wrote:
> On Tue, Nov 28, 2017 at 12:17:16PM -0500, wexu@redhat.com wrote:
> > From: Wei Xu <wexu@redhat.com>
> >
> > Matthew found a roughly 40% tcp throughput regression with commit
> > c67df11f(vhost_net: try batch dequing from skb array) as discussed
> > in the following thread:
> > https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
> >
> > Eventually we figured out that it was a skb leak in handle_rx()
> > when sending packets to the VM. This usually happens when a guest
> > can not drain out vq as fast as vhost fills in, afterwards it sets
> > off the traffic jam and leaks skb(s) which occurs as no headcount
> > to send on the vq from vhost side.
> >
> > This can be avoided by making sure we have got enough headcount
> > before actually consuming a skb from the batched rx array while
> > transmitting, which is simply done by deferring it a moment later
> > in this patch.
> >
> > Signed-off-by: Wei Xu <wexu@redhat.com>
>
> Given the amount of effort Matthew has put into this,
> you definitely want
>
> Reported-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com>
>
> here.
>
Absolutely we want that, sorry for missed you here, Matthew. It is more
like you have figured out this issue independently all by yourself with
a wide assortment of extremely quick tests(tools, throughput, slub leak,
etc), and I am happy that I have the opportunity to do the paperwork on
behalf of you.:) Thanks a lot Matthew.
Wei
> Let's give credit where credit is due.
>
> Thanks a lot Matthew!
>
> > ---
> > drivers/vhost/net.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> > index 8d626d7..e76535e 100644
> > --- a/drivers/vhost/net.c
> > +++ b/drivers/vhost/net.c
> > @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> > /* On error, stop handling until the next kick. */
> > if (unlikely(headcount < 0))
> > goto out;
> > - if (nvq->rx_array)
> > - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > /* On overrun, truncate and discard */
> > if (unlikely(headcount > UIO_MAXIOV)) {
> > iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> > @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> > */
> > iov_iter_advance(&msg.msg_iter, vhost_hlen);
> > }
> > + if (nvq->rx_array)
> > + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > err = sock->ops->recvmsg(sock, &msg,
> > sock_len, MSG_DONTWAIT | MSG_TRUNC);
> > /* Userspace might have consumed the packet meanwhile:
> > --
> > 1.8.3.1
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-28 17:17 [PATCH net,stable] vhost: fix skb leak in handle_rx() wexu
` (2 preceding siblings ...)
2017-11-28 17:53 ` Michael S. Tsirkin
@ 2017-11-29 1:53 ` Jason Wang
2017-11-29 5:06 ` Jason Wang
2017-11-29 5:06 ` Jason Wang
2017-11-29 1:53 ` Jason Wang
4 siblings, 2 replies; 16+ messages in thread
From: Jason Wang @ 2017-11-29 1:53 UTC (permalink / raw)
To: wexu, virtualization, netdev, linux-kernel; +Cc: mst, mjrosato
On 2017年11月29日 01:17, wexu@redhat.com wrote:
> From: Wei Xu <wexu@redhat.com>
>
> Matthew found a roughly 40% tcp throughput regression with commit
> c67df11f(vhost_net: try batch dequing from skb array) as discussed
> in the following thread:
> https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
>
> Eventually we figured out that it was a skb leak in handle_rx()
> when sending packets to the VM. This usually happens when a guest
> can not drain out vq as fast as vhost fills in, afterwards it sets
> off the traffic jam and leaks skb(s) which occurs as no headcount
> to send on the vq from vhost side.
>
> This can be avoided by making sure we have got enough headcount
> before actually consuming a skb from the batched rx array while
> transmitting, which is simply done by deferring it a moment later
> in this patch.
>
> Signed-off-by: Wei Xu <wexu@redhat.com>
> ---
> drivers/vhost/net.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 8d626d7..e76535e 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> /* On error, stop handling until the next kick. */
> if (unlikely(headcount < 0))
> goto out;
> - if (nvq->rx_array)
> - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> /* On overrun, truncate and discard */
> if (unlikely(headcount > UIO_MAXIOV)) {
You need do msg.msg_control = vhost_net_buf_consume() here too,
otherwise we may still get it leaked.
Thanks
> iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> */
> iov_iter_advance(&msg.msg_iter, vhost_hlen);
> }
> + if (nvq->rx_array)
> + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> err = sock->ops->recvmsg(sock, &msg,
> sock_len, MSG_DONTWAIT | MSG_TRUNC);
> /* Userspace might have consumed the packet meanwhile:
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-29 1:53 ` Jason Wang
@ 2017-11-29 5:06 ` Jason Wang
2017-11-29 5:06 ` Jason Wang
1 sibling, 0 replies; 16+ messages in thread
From: Jason Wang @ 2017-11-29 5:06 UTC (permalink / raw)
To: wexu, virtualization, netdev, linux-kernel; +Cc: mjrosato, mst
On 2017年11月29日 09:53, Jason Wang wrote:
>
>
> On 2017年11月29日 01:17, wexu@redhat.com wrote:
>> From: Wei Xu <wexu@redhat.com>
>>
>> Matthew found a roughly 40% tcp throughput regression with commit
>> c67df11f(vhost_net: try batch dequing from skb array) as discussed
>> in the following thread:
>> https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
>>
>> Eventually we figured out that it was a skb leak in handle_rx()
>> when sending packets to the VM. This usually happens when a guest
>> can not drain out vq as fast as vhost fills in, afterwards it sets
>> off the traffic jam and leaks skb(s) which occurs as no headcount
>> to send on the vq from vhost side.
>>
>> This can be avoided by making sure we have got enough headcount
>> before actually consuming a skb from the batched rx array while
>> transmitting, which is simply done by deferring it a moment later
>> in this patch.
>>
>> Signed-off-by: Wei Xu <wexu@redhat.com>
>> ---
>> drivers/vhost/net.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
>> index 8d626d7..e76535e 100644
>> --- a/drivers/vhost/net.c
>> +++ b/drivers/vhost/net.c
>> @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
>> /* On error, stop handling until the next kick. */
>> if (unlikely(headcount < 0))
>> goto out;
>> - if (nvq->rx_array)
>> - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
>> /* On overrun, truncate and discard */
>> if (unlikely(headcount > UIO_MAXIOV)) {
>
> You need do msg.msg_control = vhost_net_buf_consume() here too,
> otherwise we may still get it leaked.
>
> Thanks
Not a leak actually, but the packet won't be consumed and we will hit
UIO_MAXIOV forever in this case.
Thanks
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-29 1:53 ` Jason Wang
2017-11-29 5:06 ` Jason Wang
@ 2017-11-29 5:06 ` Jason Wang
2017-11-29 5:44 ` Wei Xu
2017-11-29 5:44 ` Wei Xu
1 sibling, 2 replies; 16+ messages in thread
From: Jason Wang @ 2017-11-29 5:06 UTC (permalink / raw)
To: wexu, virtualization, netdev, linux-kernel; +Cc: mjrosato, mst
On 2017年11月29日 09:53, Jason Wang wrote:
>
>
> On 2017年11月29日 01:17, wexu@redhat.com wrote:
>> From: Wei Xu <wexu@redhat.com>
>>
>> Matthew found a roughly 40% tcp throughput regression with commit
>> c67df11f(vhost_net: try batch dequing from skb array) as discussed
>> in the following thread:
>> https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
>>
>> Eventually we figured out that it was a skb leak in handle_rx()
>> when sending packets to the VM. This usually happens when a guest
>> can not drain out vq as fast as vhost fills in, afterwards it sets
>> off the traffic jam and leaks skb(s) which occurs as no headcount
>> to send on the vq from vhost side.
>>
>> This can be avoided by making sure we have got enough headcount
>> before actually consuming a skb from the batched rx array while
>> transmitting, which is simply done by deferring it a moment later
>> in this patch.
>>
>> Signed-off-by: Wei Xu <wexu@redhat.com>
>> ---
>> drivers/vhost/net.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
>> index 8d626d7..e76535e 100644
>> --- a/drivers/vhost/net.c
>> +++ b/drivers/vhost/net.c
>> @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
>> /* On error, stop handling until the next kick. */
>> if (unlikely(headcount < 0))
>> goto out;
>> - if (nvq->rx_array)
>> - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
>> /* On overrun, truncate and discard */
>> if (unlikely(headcount > UIO_MAXIOV)) {
>
> You need do msg.msg_control = vhost_net_buf_consume() here too,
> otherwise we may still get it leaked.
>
> Thanks
Not a leak actually, but the packet won't be consumed and we will hit
UIO_MAXIOV forever in this case.
Thanks
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-29 5:06 ` Jason Wang
@ 2017-11-29 5:44 ` Wei Xu
2017-11-29 5:44 ` Wei Xu
1 sibling, 0 replies; 16+ messages in thread
From: Wei Xu @ 2017-11-29 5:44 UTC (permalink / raw)
To: Jason Wang; +Cc: mjrosato, netdev, mst, linux-kernel, virtualization
On Wed, Nov 29, 2017 at 01:06:28PM +0800, Jason Wang wrote:
>
>
> On 2017年11月29日 09:53, Jason Wang wrote:
> >
> >
> > On 2017年11月29日 01:17, wexu@redhat.com wrote:
> > > From: Wei Xu <wexu@redhat.com>
> > >
> > > Matthew found a roughly 40% tcp throughput regression with commit
> > > c67df11f(vhost_net: try batch dequing from skb array) as discussed
> > > in the following thread:
> > > https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
> > >
> > > Eventually we figured out that it was a skb leak in handle_rx()
> > > when sending packets to the VM. This usually happens when a guest
> > > can not drain out vq as fast as vhost fills in, afterwards it sets
> > > off the traffic jam and leaks skb(s) which occurs as no headcount
> > > to send on the vq from vhost side.
> > >
> > > This can be avoided by making sure we have got enough headcount
> > > before actually consuming a skb from the batched rx array while
> > > transmitting, which is simply done by deferring it a moment later
> > > in this patch.
> > >
> > > Signed-off-by: Wei Xu <wexu@redhat.com>
> > > ---
> > > drivers/vhost/net.c | 4 ++--
> > > 1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> > > index 8d626d7..e76535e 100644
> > > --- a/drivers/vhost/net.c
> > > +++ b/drivers/vhost/net.c
> > > @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> > > /* On error, stop handling until the next kick. */
> > > if (unlikely(headcount < 0))
> > > goto out;
> > > - if (nvq->rx_array)
> > > - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > > /* On overrun, truncate and discard */
> > > if (unlikely(headcount > UIO_MAXIOV)) {
> >
> > You need do msg.msg_control = vhost_net_buf_consume() here too,
> > otherwise we may still get it leaked.
> >
> > Thanks
>
> Not a leak actually, but the packet won't be consumed and we will hit
> UIO_MAXIOV forever in this case.
I see, thanks, will make a v2.
>
> Thanks
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-29 5:06 ` Jason Wang
2017-11-29 5:44 ` Wei Xu
@ 2017-11-29 5:44 ` Wei Xu
1 sibling, 0 replies; 16+ messages in thread
From: Wei Xu @ 2017-11-29 5:44 UTC (permalink / raw)
To: Jason Wang; +Cc: virtualization, netdev, linux-kernel, mjrosato, mst
On Wed, Nov 29, 2017 at 01:06:28PM +0800, Jason Wang wrote:
>
>
> On 2017年11月29日 09:53, Jason Wang wrote:
> >
> >
> > On 2017年11月29日 01:17, wexu@redhat.com wrote:
> > > From: Wei Xu <wexu@redhat.com>
> > >
> > > Matthew found a roughly 40% tcp throughput regression with commit
> > > c67df11f(vhost_net: try batch dequing from skb array) as discussed
> > > in the following thread:
> > > https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
> > >
> > > Eventually we figured out that it was a skb leak in handle_rx()
> > > when sending packets to the VM. This usually happens when a guest
> > > can not drain out vq as fast as vhost fills in, afterwards it sets
> > > off the traffic jam and leaks skb(s) which occurs as no headcount
> > > to send on the vq from vhost side.
> > >
> > > This can be avoided by making sure we have got enough headcount
> > > before actually consuming a skb from the batched rx array while
> > > transmitting, which is simply done by deferring it a moment later
> > > in this patch.
> > >
> > > Signed-off-by: Wei Xu <wexu@redhat.com>
> > > ---
> > > drivers/vhost/net.c | 4 ++--
> > > 1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> > > index 8d626d7..e76535e 100644
> > > --- a/drivers/vhost/net.c
> > > +++ b/drivers/vhost/net.c
> > > @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> > > /* On error, stop handling until the next kick. */
> > > if (unlikely(headcount < 0))
> > > goto out;
> > > - if (nvq->rx_array)
> > > - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> > > /* On overrun, truncate and discard */
> > > if (unlikely(headcount > UIO_MAXIOV)) {
> >
> > You need do msg.msg_control = vhost_net_buf_consume() here too,
> > otherwise we may still get it leaked.
> >
> > Thanks
>
> Not a leak actually, but the packet won't be consumed and we will hit
> UIO_MAXIOV forever in this case.
I see, thanks, will make a v2.
>
> Thanks
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH net,stable] vhost: fix skb leak in handle_rx()
2017-11-28 17:17 [PATCH net,stable] vhost: fix skb leak in handle_rx() wexu
` (3 preceding siblings ...)
2017-11-29 1:53 ` Jason Wang
@ 2017-11-29 1:53 ` Jason Wang
4 siblings, 0 replies; 16+ messages in thread
From: Jason Wang @ 2017-11-29 1:53 UTC (permalink / raw)
To: wexu, virtualization, netdev, linux-kernel; +Cc: mjrosato, mst
On 2017年11月29日 01:17, wexu@redhat.com wrote:
> From: Wei Xu <wexu@redhat.com>
>
> Matthew found a roughly 40% tcp throughput regression with commit
> c67df11f(vhost_net: try batch dequing from skb array) as discussed
> in the following thread:
> https://www.mail-archive.com/netdev@vger.kernel.org/msg187936.html
>
> Eventually we figured out that it was a skb leak in handle_rx()
> when sending packets to the VM. This usually happens when a guest
> can not drain out vq as fast as vhost fills in, afterwards it sets
> off the traffic jam and leaks skb(s) which occurs as no headcount
> to send on the vq from vhost side.
>
> This can be avoided by making sure we have got enough headcount
> before actually consuming a skb from the batched rx array while
> transmitting, which is simply done by deferring it a moment later
> in this patch.
>
> Signed-off-by: Wei Xu <wexu@redhat.com>
> ---
> drivers/vhost/net.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 8d626d7..e76535e 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -778,8 +778,6 @@ static void handle_rx(struct vhost_net *net)
> /* On error, stop handling until the next kick. */
> if (unlikely(headcount < 0))
> goto out;
> - if (nvq->rx_array)
> - msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> /* On overrun, truncate and discard */
> if (unlikely(headcount > UIO_MAXIOV)) {
You need do msg.msg_control = vhost_net_buf_consume() here too,
otherwise we may still get it leaked.
Thanks
> iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
> @@ -809,6 +807,8 @@ static void handle_rx(struct vhost_net *net)
> */
> iov_iter_advance(&msg.msg_iter, vhost_hlen);
> }
> + if (nvq->rx_array)
> + msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
> err = sock->ops->recvmsg(sock, &msg,
> sock_len, MSG_DONTWAIT | MSG_TRUNC);
> /* Userspace might have consumed the packet meanwhile:
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
^ permalink raw reply [flat|nested] 16+ messages in thread