net/virtio: fix split queue vectorized Rx

[ upstream commit c97e737 ]

Descriptors number may be set less than queue size for split queue
vectorized Rx path. Pointers to mbufs for received packets are
obtained from SW ring, that is initially filled with them in the end
of queue setup in virtio_dev_rx_queue_setup_finish(). The begin of the
SW ring filled up to the size of descriptors number. At queue size
offset from the begin of the SW ring pointers to some fake mbuf are also
set for wrapping purpose. So the ring may contains the hole of invalid
pointers from descriptors number offset to queue size offset, and split
vectorized Rx routines could write to the invalid addresses since they
use the ring up to the queue size. Fix this by setting descriptors
number to queue size on Rx queue setup.

Fixes: fc3d662 ("virtio: add vector Rx")

Signed-off-by: Ivan Ilchenko <ivan.ilchenko@oktetlabs.ru>
Signed-off-by: Andrew Rybchenko <andrew.rybchenko@oktetlabs.ru>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>

drivers/net/virtio/virtio_rxtx.c

@@ -711,8 +711,14 @@ virtio_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	}
 	vq->vq_free_thresh = rx_free_thresh;
 
-	if (nb_desc == 0 || nb_desc > vq->vq_nentries)
+	/*
+	 * For split ring vectorized path descriptors number must be
+	 * equal to the ring size.
+	 */
+	if (nb_desc > vq->vq_nentries ||
+	    (!vtpci_packed_queue(hw) && hw->use_vec_rx)) {
 		nb_desc = vq->vq_nentries;
+	}
 	vq->vq_free_cnt = RTE_MIN(vq->vq_free_cnt, nb_desc);
 
 	rxvq = &vq->rxq;