On Sun, Dec 27, 2020 at 6:26 AM Michael S. Tsirkin [off-list ref] wrote:

On Fri, Dec 25, 2020 at 03:24:25PM +0800, wangyunjian wrote:

quoted

From: Yunjian Wang <redacted>

Currently the vhost_zerocopy_callback() maybe be called to decrease
the refcount when sendmsg fails in tun. The error handling in vhost
handle_tx_zerocopy() will try to decrease the same refcount again.
This is wrong. To fix this issue, we only call vhost_net_ubuf_put()
when vq->heads[nvq->desc].len == VHOST_DMA_IN_PROGRESS.

Fixes: 0690899b4d45 ("tun: experimental zero copy tx support")

Are you sure about this tag? the patch in question only affects
tun, while the fix only affects vhost.

That was my suggestion. But you're right. Perhaps better:

Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")

That introduces the actual block that releases the buffer on error:

"
                err = sock->ops->sendmsg(NULL, sock, &msg, len);
                if (unlikely(err < 0)) {
+                       if (zcopy) {
+                               if (ubufs)
+                                       vhost_ubuf_put(ubufs);
+                               vq->upend_idx = ((unsigned)vq->upend_idx - 1) %
+                                       UIO_MAXIOV;
+                       }
"