Re: virtio_net: support device stats
From: Colin King (gmail)
Date: Mon Oct 14 2024 - 06:15:06 EST
On 14/10/2024 10:47, Michael S. Tsirkin wrote:
On Mon, Oct 14, 2024 at 10:39:26AM +0100, Colin King (gmail) wrote:
Hi,
Static analysis on Linux-next has detected a potential issue with the
following commit:
commit 941168f8b40e50518a3bc6ce770a7062a5d99230
Author: Xuan Zhuo <xuanzhuo@xxxxxxxxxxxxxxxxx>
Date: Fri Apr 26 11:39:24 2024 +0800
virtio_net: support device stats
The issue is in function virtnet_stats_ctx_init, in drivers/net/virtio_net.c
as follows:
if (vi->device_stats_cap & VIRTIO_NET_STATS_TYPE_CVQ) {
queue_type = VIRTNET_Q_TYPE_CQ;
ctx->bitmap[queue_type] |= VIRTIO_NET_STATS_TYPE_CVQ;
ctx->desc_num[queue_type] +=
ARRAY_SIZE(virtnet_stats_cvq_desc);
ctx->size[queue_type] += sizeof(struct
virtio_net_stats_cvq);
}
ctx->bitmap is declared as a u32 however it is being bit-wise or'd with
VIRTIO_NET_STATS_TYPE_CVQ and this is defined as 1 << 32:
include/uapi/linux/virtio_net.h:#define VIRTIO_NET_STATS_TYPE_CVQ (1ULL <<
32)
..and hence the bit-wise or operation won't set any bits in ctx->bitmap
because 1ULL < 32 is too wide for a u32.
Indeed. Xuan Zhuo how did you test this patch?
I suspect ctx->bitmap should be
declared as u64.
Colin
In fact, it is read into a u64:
u64 offset, bitmap;
....
bitmap = ctx->bitmap[queue_type];
we'll have to reorder fields to avoid wasting memory.
Like this I guess:
Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
Colin, can you confirm pls?
Fix looks sane to be, with u64 bitmap[3] struct size field re-ordering
does not seem to make any difference on x86-64 (64 bytes) and i586 (56
bytes) when I compiled with gcc-12, gcc-14 and clang-20.
I can't functionally test this though (not sure how).
Reviewed-by: Colin Ian King <colin.king@xxxxxxxxx>
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index c6af18948092..ef221429f784 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -4111,12 +4111,12 @@ struct virtnet_stats_ctx {
/* Used to calculate the offset inside the output buffer. */
u32 desc_num[3];
- /* The actual supported stat types. */
- u32 bitmap[3];
-
/* Used to calculate the reply buffer size. */
u32 size[3];
+ /* The actual supported stat types. */
+ u64 bitmap[3];
+
/* Record the output buffer. */
u64 *data;
};