-----Original Message-----
From: Willem de Bruijn [mailto:willemdebruijn.kernel@gmail.com]
Sent: Monday, December 28, 2020 12:15 AM
To: Michael S. Tsirkin <mst@redhat.com>
Cc: wangyunjian <redacted>; Network Development
[off-list ref]; Jason Wang [off-list ref]; Willem de
Bruijn [off-list ref];
virtualization@lists.linux-foundation.org; Lilijun (Jerry)
[off-list ref]; chenchanghu [off-list ref];
xudingke [off-list ref]; huangbin (J)
[off-list ref]
Subject: Re: [PATCH net v5 1/2] vhost_net: fix ubuf refcount incorrectly when
sendmsg fails

On Sun, Dec 27, 2020 at 6:26 AM Michael S. Tsirkin [off-list ref] wrote:

quoted

On Fri, Dec 25, 2020 at 03:24:25PM +0800, wangyunjian wrote:

quoted

From: Yunjian Wang <redacted>

Currently the vhost_zerocopy_callback() maybe be called to decrease
the refcount when sendmsg fails in tun. The error handling in vhost
handle_tx_zerocopy() will try to decrease the same refcount again.
This is wrong. To fix this issue, we only call vhost_net_ubuf_put()
when vq->heads[nvq->desc].len == VHOST_DMA_IN_PROGRESS.

Fixes: 0690899b4d45 ("tun: experimental zero copy tx support")

Are you sure about this tag? the patch in question only affects tun,
while the fix only affects vhost.

That was my suggestion. But you're right. Perhaps better:

Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")

OK, thanks, I will fix it in next version.

That introduces the actual block that releases the buffer on error:

"
                err = sock->ops->sendmsg(NULL, sock, &msg, len);
                if (unlikely(err < 0)) {
+                       if (zcopy) {
+                               if (ubufs)
+                                       vhost_ubuf_put(ubufs);
+                               vq->upend_idx =
((unsigned)vq->upend_idx - 1) %
+                                       UIO_MAXIOV;
+                       }
"