From: Michael S. Tsirkin Date: Tue, 24 Mar 2026 15:15:54 +0000 (-0400) Subject: virtio_net: sync RX buffer before reading the header X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fe3e54253f0b04ec9e85d46e10aadbdbb31d29b2;p=thirdparty%2Flinux.git virtio_net: sync RX buffer before reading the header receive_buf() reads the virtio header through buf before page_pool_dma_sync_for_cpu() runs in receive_small() or receive_mergeable(). The header buffer is thus unsynchronized at the point where flags and, for mergeable buffers, num_buffers are consumed. Omar Elghoul reported that on s390x Secure Execution this showed up as greatly reduced virtio-net performance together with "bad gso" and "bad csum" messages in dmesg. This is because with SE sync actually copies data, so the header is uninitialized. Move the sync into receive_buf() so the header is synchronized before any access through buf. Tool use: Cursor with GPT-5.4 drafted the initial code move from prompt: "in drivers/net/virtio_net.c, move page_pool_dma_sync_for_cpu on receive path to before memory is accessed through buf". The result and the commit log were reviewed and edited manually. Fixes: 24fbd3967f3f ("virtio_net: add page_pool support for buffer allocation") Reported-by: Omar Elghoul Tested-by: Srikanth Aithal Tested-by: Omar Elghoul Link: https://lore.kernel.org/r/20260323150136.14452-1-oelghoul@linux.ibm.com Signed-off-by: Michael S. Tsirkin Tested-by: Vishwanath Seshagiri Acked-by: Jason Wang Link: https://patch.msgid.link/f4caa9be9e5addae7851c012cab0a733be7f0974.1774365273.git.mst@redhat.com Signed-off-by: Jakub Kicinski --- diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index bce885dc234b..9cf240afe81e 100644 --- a/drivers/net/virtio_net.c +++ b/drivers/net/virtio_net.c @@ -1956,13 +1956,6 @@ static struct sk_buff *receive_small(struct net_device *dev, */ buf -= VIRTNET_RX_PAD + xdp_headroom; - if (rq->use_page_pool_dma) { - int offset = buf - page_address(page) + - VIRTNET_RX_PAD + xdp_headroom; - - page_pool_dma_sync_for_cpu(rq->page_pool, page, offset, len); - } - len -= vi->hdr_len; u64_stats_add(&stats->bytes, len); @@ -2398,9 +2391,6 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, head_skb = NULL; - if (rq->use_page_pool_dma) - page_pool_dma_sync_for_cpu(rq->page_pool, page, offset, len); - u64_stats_add(&stats->bytes, len - vi->hdr_len); if (check_mergeable_len(dev, ctx, len)) @@ -2563,6 +2553,16 @@ static void receive_buf(struct virtnet_info *vi, struct receive_queue *rq, return; } + /* Sync the memory before touching anything through buf, + * unless virtio core did it already. + */ + if (rq->use_page_pool_dma) { + struct page *page = virt_to_head_page(buf); + int offset = buf - page_address(page); + + page_pool_dma_sync_for_cpu(rq->page_pool, page, offset, len); + } + /* About the flags below: * 1. Save the flags early, as the XDP program might overwrite them. * These flags ensure packets marked as VIRTIO_NET_HDR_F_DATA_VALID