Patch Detail

HTTP 200 OK
Allow: GET, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 79011,
    "url": "http://patches.dpdk.org/api/patches/79011/?format=api",
    "web_url": "http://patches.dpdk.org/project/dpdk/patch/20200928105918.740807-6-ferruh.yigit@intel.com/",
    "project": {
        "id": 1,
        "url": "http://patches.dpdk.org/api/projects/1/?format=api",
        "name": "DPDK",
        "link_name": "dpdk",
        "list_id": "dev.dpdk.org",
        "list_email": "dev@dpdk.org",
        "web_url": "http://core.dpdk.org",
        "scm_url": "git://dpdk.org/dpdk",
        "webscm_url": "http://git.dpdk.org/dpdk",
        "list_archive_url": "https://inbox.dpdk.org/dev",
        "list_archive_url_format": "https://inbox.dpdk.org/dev/{}",
        "commit_url_format": ""
    },
    "msgid": "<20200928105918.740807-6-ferruh.yigit@intel.com>",
    "list_archive_url": "https://inbox.dpdk.org/dev/20200928105918.740807-6-ferruh.yigit@intel.com",
    "date": "2020-09-28T10:59:18",
    "name": "[6/6] vhost/crypto: fix possible TOCTOU attack",
    "commit_ref": null,
    "pull_url": null,
    "state": "accepted",
    "archived": true,
    "hash": "f4cfe8487c3eeb2a962ec67d9c4b20e02e50e688",
    "submitter": {
        "id": 324,
        "url": "http://patches.dpdk.org/api/people/324/?format=api",
        "name": "Ferruh Yigit",
        "email": "ferruh.yigit@intel.com"
    },
    "delegate": {
        "id": 1,
        "url": "http://patches.dpdk.org/api/users/1/?format=api",
        "username": "tmonjalo",
        "first_name": "Thomas",
        "last_name": "Monjalon",
        "email": "thomas@monjalon.net"
    },
    "mbox": "http://patches.dpdk.org/project/dpdk/patch/20200928105918.740807-6-ferruh.yigit@intel.com/mbox/",
    "series": [
        {
            "id": 12553,
            "url": "http://patches.dpdk.org/api/series/12553/?format=api",
            "web_url": "http://patches.dpdk.org/project/dpdk/list/?series=12553",
            "date": "2020-09-28T10:59:13",
            "name": "[1/6] vhost/crypto: fix pool allocation",
            "version": 1,
            "mbox": "http://patches.dpdk.org/series/12553/mbox/"
        }
    ],
    "comments": "http://patches.dpdk.org/api/patches/79011/comments/",
    "check": "success",
    "checks": "http://patches.dpdk.org/api/patches/79011/checks/",
    "tags": {},
    "related": [],
    "headers": {
        "Return-Path": "<dev-bounces@dpdk.org>",
        "X-Original-To": "patchwork@inbox.dpdk.org",
        "Delivered-To": "patchwork@inbox.dpdk.org",
        "Received": [
            "from dpdk.org (dpdk.org [92.243.14.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id 2FC1BA04C3;\n\tMon, 28 Sep 2020 13:01:16 +0200 (CEST)",
            "from [92.243.14.124] (localhost [127.0.0.1])\n\tby dpdk.org (Postfix) with ESMTP id 0A50A1D924;\n\tMon, 28 Sep 2020 12:59:44 +0200 (CEST)",
            "from mga07.intel.com (mga07.intel.com [134.134.136.100])\n by dpdk.org (Postfix) with ESMTP id E97FA1D911;\n Mon, 28 Sep 2020 12:59:39 +0200 (CEST)",
            "from fmsmga005.fm.intel.com ([10.253.24.32])\n by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384;\n 28 Sep 2020 03:59:39 -0700",
            "from silpixa00399752.ir.intel.com (HELO\n silpixa00399752.ger.corp.intel.com) ([10.237.222.180])\n by fmsmga005.fm.intel.com with ESMTP; 28 Sep 2020 03:59:37 -0700"
        ],
        "IronPort-SDR": [
            "\n I3qA5NmfXieM1PxqzLiwH5Q4npk+bPruH6YXgAP2yf6XJVaRw/Aghey+ERGDcC8iE6Nj3NllcK\n h4mg0KBLxZ6Q==",
            "\n 5vfdgmVWPSlESUu3pNX1S4jTnJwSFgab7WiYQzcgb7ZK6eNyJoDr+scg1+BnrepzHElJ0rURqU\n +PvmZcsRr/CQ=="
        ],
        "X-IronPort-AV": [
            "E=McAfee;i=\"6000,8403,9757\"; a=\"226122064\"",
            "E=Sophos;i=\"5.77,313,1596524400\"; d=\"scan'208\";a=\"226122064\"",
            "E=Sophos;i=\"5.77,313,1596524400\"; d=\"scan'208\";a=\"514212893\""
        ],
        "X-Amp-Result": "SKIPPED(no attachment in message)",
        "X-Amp-File-Uploaded": "False",
        "X-ExtLoop1": "1",
        "From": "Ferruh Yigit <ferruh.yigit@intel.com>",
        "To": "Maxime Coquelin <maxime.coquelin@redhat.com>,\n Chenbo Xia <chenbo.xia@intel.com>, Zhihong Wang <zhihong.wang@intel.com>,\n Jay Zhou <jianjay.zhou@huawei.com>, Fan Zhang <roy.fan.zhang@intel.com>",
        "Cc": "dev@dpdk.org,\n\tFerruh Yigit <ferruh.yigit@intel.com>,\n\tstable@dpdk.org",
        "Date": "Mon, 28 Sep 2020 11:59:18 +0100",
        "Message-Id": "<20200928105918.740807-6-ferruh.yigit@intel.com>",
        "X-Mailer": "git-send-email 2.26.2",
        "In-Reply-To": "<20200928105918.740807-1-ferruh.yigit@intel.com>",
        "References": "<20200928105918.740807-1-ferruh.yigit@intel.com>",
        "MIME-Version": "1.0",
        "Content-Transfer-Encoding": "8bit",
        "Subject": "[dpdk-dev] [PATCH 6/6] vhost/crypto: fix possible TOCTOU attack",
        "X-BeenThere": "dev@dpdk.org",
        "X-Mailman-Version": "2.1.15",
        "Precedence": "list",
        "List-Id": "DPDK patches and discussions <dev.dpdk.org>",
        "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>",
        "List-Archive": "<http://mails.dpdk.org/archives/dev/>",
        "List-Post": "<mailto:dev@dpdk.org>",
        "List-Help": "<mailto:dev-request@dpdk.org?subject=help>",
        "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>",
        "Errors-To": "dev-bounces@dpdk.org",
        "Sender": "\"dev\" <dev-bounces@dpdk.org>"
    },
    "content": "From: Fan Zhang <roy.fan.zhang@intel.com>\n\nThis patch fixes the possible time-of-check to time-of-use (TOCTOU)\nattack problem by copying request data and descriptor index to local\nvariable prior to process.\n\nAlso the original sequential read of descriptors may lead to TOCTOU\nattack. This patch fixes the problem by loading all descriptors of a\nrequest to local buffer before processing.\n\nCVE-2020-14375\nFixes: 3bb595ecd682 (\"vhost/crypto: add request handler\")\nCc: stable@dpdk.org\n\nSigned-off-by: Fan Zhang <roy.fan.zhang@intel.com>\nAcked-by: Chenbo Xia <chenbo.xia@intel.com>\n---\n lib/librte_vhost/rte_vhost_crypto.h |   2 +\n lib/librte_vhost/vhost_crypto.c     | 391 ++++++++++++++--------------\n 2 files changed, 202 insertions(+), 191 deletions(-)",
    "diff": "diff --git a/lib/librte_vhost/rte_vhost_crypto.h b/lib/librte_vhost/rte_vhost_crypto.h\nindex 866a592a5d..b54d61db69 100644\n--- a/lib/librte_vhost/rte_vhost_crypto.h\n+++ b/lib/librte_vhost/rte_vhost_crypto.h\n@@ -7,10 +7,12 @@\n \n #define VHOST_CRYPTO_MBUF_POOL_SIZE\t\t(8192)\n #define VHOST_CRYPTO_MAX_BURST_SIZE\t\t(64)\n+#define VHOST_CRYPTO_MAX_DATA_SIZE\t\t(4096)\n #define VHOST_CRYPTO_SESSION_MAP_ENTRIES\t(1024) /**< Max nb sessions */\n /** max nb virtual queues in a burst for finalizing*/\n #define VIRTIO_CRYPTO_MAX_NUM_BURST_VQS\t\t(64)\n #define VHOST_CRYPTO_MAX_IV_LEN\t\t\t(32)\n+#define VHOST_CRYPTO_MAX_N_DESC\t\t\t(32)\n \n enum rte_vhost_crypto_zero_copy {\n \tRTE_VHOST_CRYPTO_ZERO_COPY_DISABLE = 0,\ndiff --git a/lib/librte_vhost/vhost_crypto.c b/lib/librte_vhost/vhost_crypto.c\nindex cf9aa2566b..e08f9c6d75 100644\n--- a/lib/librte_vhost/vhost_crypto.c\n+++ b/lib/librte_vhost/vhost_crypto.c\n@@ -46,6 +46,14 @@\n #define IOVA_TO_VVA(t, r, a, l, p)\t\t\t\t\t\\\n \t((t)(uintptr_t)vhost_iova_to_vva(r->dev, r->vq, a, l, p))\n \n+/*\n+ * vhost_crypto_desc is used to copy original vring_desc to the local buffer\n+ * before processing (except the next index). The copy result will be an\n+ * array of vhost_crypto_desc elements that follows the sequence of original\n+ * vring_desc.next is arranged.\n+ */\n+#define vhost_crypto_desc vring_desc\n+\n static int\n cipher_algo_transform(uint32_t virtio_cipher_algo,\n \t\tenum rte_crypto_cipher_algorithm *algo)\n@@ -479,83 +487,71 @@ vhost_crypto_msg_post_handler(int vid, void *msg)\n \treturn ret;\n }\n \n-static __rte_always_inline struct vring_desc *\n-find_write_desc(struct vring_desc *head, struct vring_desc *desc,\n-\t\tuint32_t *nb_descs, uint32_t vq_size)\n+static __rte_always_inline struct vhost_crypto_desc *\n+find_write_desc(struct vhost_crypto_desc *head, struct vhost_crypto_desc *desc,\n+\t\tuint32_t max_n_descs)\n {\n-\tif (desc->flags & VRING_DESC_F_WRITE)\n-\t\treturn desc;\n-\n-\twhile (desc->flags & VRING_DESC_F_NEXT) {\n-\t\tif (unlikely(*nb_descs == 0 || desc->next >= vq_size))\n-\t\t\treturn NULL;\n-\t\t(*nb_descs)--;\n+\tif (desc < head)\n+\t\treturn NULL;\n \n-\t\tdesc = &head[desc->next];\n+\twhile (desc - head < (int)max_n_descs) {\n \t\tif (desc->flags & VRING_DESC_F_WRITE)\n \t\t\treturn desc;\n+\t\tdesc++;\n \t}\n \n \treturn NULL;\n }\n \n-static struct virtio_crypto_inhdr *\n-reach_inhdr(struct vhost_crypto_data_req *vc_req, struct vring_desc *desc,\n-\t\tuint32_t *nb_descs, uint32_t vq_size)\n+static __rte_always_inline struct virtio_crypto_inhdr *\n+reach_inhdr(struct vhost_crypto_data_req *vc_req,\n+\t\tstruct vhost_crypto_desc *head,\n+\t\tuint32_t max_n_descs)\n {\n-\tuint64_t dlen;\n \tstruct virtio_crypto_inhdr *inhdr;\n+\tstruct vhost_crypto_desc *last = head + (max_n_descs - 1);\n+\tuint64_t dlen = last->len;\n \n-\twhile (desc->flags & VRING_DESC_F_NEXT) {\n-\t\tif (unlikely(*nb_descs == 0 || desc->next >= vq_size))\n-\t\t\treturn NULL;\n-\t\t(*nb_descs)--;\n-\t\tdesc = &vc_req->head[desc->next];\n-\t}\n+\tif (unlikely(dlen != sizeof(*inhdr)))\n+\t\treturn NULL;\n \n-\tdlen = desc->len;\n-\tinhdr = IOVA_TO_VVA(struct virtio_crypto_inhdr *, vc_req, desc->addr,\n+\tinhdr = IOVA_TO_VVA(struct virtio_crypto_inhdr *, vc_req, last->addr,\n \t\t\t&dlen, VHOST_ACCESS_WO);\n-\tif (unlikely(!inhdr || dlen != desc->len))\n+\tif (unlikely(!inhdr || dlen != last->len))\n \t\treturn NULL;\n \n \treturn inhdr;\n }\n \n static __rte_always_inline int\n-move_desc(struct vring_desc *head, struct vring_desc **cur_desc,\n-\t\tuint32_t size, uint32_t *nb_descs, uint32_t vq_size)\n+move_desc(struct vhost_crypto_desc *head,\n+\t\tstruct vhost_crypto_desc **cur_desc,\n+\t\tuint32_t size, uint32_t max_n_descs)\n {\n-\tstruct vring_desc *desc = *cur_desc;\n+\tstruct vhost_crypto_desc *desc = *cur_desc;\n \tint left = size - desc->len;\n \n-\twhile ((desc->flags & VRING_DESC_F_NEXT) && left > 0) {\n-\t\tif (unlikely(*nb_descs == 0 || desc->next >= vq_size))\n-\t\t\treturn -1;\n-\n-\t\tdesc = &head[desc->next];\n-\t\trte_prefetch0(&head[desc->next]);\n+\twhile (desc->flags & VRING_DESC_F_NEXT && left > 0 &&\n+\t\t\tdesc >= head &&\n+\t\t\tdesc - head < (int)max_n_descs) {\n+\t\tdesc++;\n \t\tleft -= desc->len;\n-\t\tif (left > 0)\n-\t\t\t(*nb_descs)--;\n \t}\n \n \tif (unlikely(left > 0))\n \t\treturn -1;\n \n-\tif (unlikely(*nb_descs == 0))\n+\tif (unlikely(head - desc == (int)max_n_descs))\n \t\t*cur_desc = NULL;\n-\telse {\n-\t\tif (unlikely(desc->next >= vq_size))\n-\t\t\treturn -1;\n-\t\t*cur_desc = &head[desc->next];\n-\t}\n+\telse\n+\t\t*cur_desc = desc + 1;\n \n \treturn 0;\n }\n \n static __rte_always_inline void *\n-get_data_ptr(struct vhost_crypto_data_req *vc_req, struct vring_desc *cur_desc,\n+get_data_ptr(struct vhost_crypto_data_req *vc_req,\n+\t\tstruct vhost_crypto_desc *cur_desc,\n \t\tuint8_t perm)\n {\n \tvoid *data;\n@@ -570,12 +566,13 @@ get_data_ptr(struct vhost_crypto_data_req *vc_req, struct vring_desc *cur_desc,\n \treturn data;\n }\n \n-static int\n+static __rte_always_inline int\n copy_data(void *dst_data, struct vhost_crypto_data_req *vc_req,\n-\t\tstruct vring_desc **cur_desc, uint32_t size,\n-\t\tuint32_t *nb_descs, uint32_t vq_size)\n+\t\tstruct vhost_crypto_desc *head,\n+\t\tstruct vhost_crypto_desc **cur_desc,\n+\t\tuint32_t size, uint32_t max_n_descs)\n {\n-\tstruct vring_desc *desc = *cur_desc;\n+\tstruct vhost_crypto_desc *desc = *cur_desc;\n \tuint64_t remain, addr, dlen, len;\n \tuint32_t to_copy;\n \tuint8_t *data = dst_data;\n@@ -614,15 +611,8 @@ copy_data(void *dst_data, struct vhost_crypto_data_req *vc_req,\n \n \tleft -= to_copy;\n \n-\twhile ((desc->flags & VRING_DESC_F_NEXT) && left > 0) {\n-\t\tif (unlikely(*nb_descs == 0 || desc->next >= vq_size)) {\n-\t\t\tVC_LOG_ERR(\"Invalid descriptors\");\n-\t\t\treturn -1;\n-\t\t}\n-\t\t(*nb_descs)--;\n-\n-\t\tdesc = &vc_req->head[desc->next];\n-\t\trte_prefetch0(&vc_req->head[desc->next]);\n+\twhile (desc >= head && desc - head < (int)max_n_descs && left) {\n+\t\tdesc++;\n \t\tto_copy = RTE_MIN(desc->len, (uint32_t)left);\n \t\tdlen = to_copy;\n \t\tsrc = IOVA_TO_VVA(uint8_t *, vc_req, desc->addr, &dlen,\n@@ -663,13 +653,10 @@ copy_data(void *dst_data, struct vhost_crypto_data_req *vc_req,\n \t\treturn -1;\n \t}\n \n-\tif (unlikely(*nb_descs == 0))\n+\tif (unlikely(desc - head == (int)max_n_descs))\n \t\t*cur_desc = NULL;\n-\telse {\n-\t\tif (unlikely(desc->next >= vq_size))\n-\t\t\treturn -1;\n-\t\t*cur_desc = &vc_req->head[desc->next];\n-\t}\n+\telse\n+\t\t*cur_desc = desc + 1;\n \n \treturn 0;\n }\n@@ -681,6 +668,7 @@ write_back_data(struct vhost_crypto_data_req *vc_req)\n \n \twhile (wb_data) {\n \t\trte_memcpy(wb_data->dst, wb_data->src, wb_data->len);\n+\t\tmemset(wb_data->src, 0, wb_data->len);\n \t\twb_last = wb_data;\n \t\twb_data = wb_data->next;\n \t\trte_mempool_put(vc_req->wb_pool, wb_last);\n@@ -722,17 +710,18 @@ free_wb_data(struct vhost_crypto_writeback_data *wb_data,\n  * @return\n  *   The pointer to the start of the write back data linked list.\n  */\n-static struct vhost_crypto_writeback_data *\n+static __rte_always_inline struct vhost_crypto_writeback_data *\n prepare_write_back_data(struct vhost_crypto_data_req *vc_req,\n-\t\tstruct vring_desc **cur_desc,\n+\t\tstruct vhost_crypto_desc *head_desc,\n+\t\tstruct vhost_crypto_desc **cur_desc,\n \t\tstruct vhost_crypto_writeback_data **end_wb_data,\n \t\tuint8_t *src,\n \t\tuint32_t offset,\n \t\tuint64_t write_back_len,\n-\t\tuint32_t *nb_descs, uint32_t vq_size)\n+\t\tuint32_t max_n_descs)\n {\n \tstruct vhost_crypto_writeback_data *wb_data, *head;\n-\tstruct vring_desc *desc = *cur_desc;\n+\tstruct vhost_crypto_desc *desc = *cur_desc;\n \tuint64_t dlen;\n \tuint8_t *dst;\n \tint ret;\n@@ -775,14 +764,10 @@ prepare_write_back_data(struct vhost_crypto_data_req *vc_req,\n \t} else\n \t\toffset -= desc->len;\n \n-\twhile (write_back_len) {\n-\t\tif (unlikely(*nb_descs == 0 || desc->next >= vq_size)) {\n-\t\t\tVC_LOG_ERR(\"Invalid descriptors\");\n-\t\t\tgoto error_exit;\n-\t\t}\n-\t\t(*nb_descs)--;\n-\n-\t\tdesc = &vc_req->head[desc->next];\n+\twhile (write_back_len &&\n+\t\t\tdesc >= head_desc &&\n+\t\t\tdesc - head_desc < (int)max_n_descs) {\n+\t\tdesc++;\n \t\tif (unlikely(!(desc->flags & VRING_DESC_F_WRITE))) {\n \t\t\tVC_LOG_ERR(\"incorrect descriptor\");\n \t\t\tgoto error_exit;\n@@ -821,13 +806,10 @@ prepare_write_back_data(struct vhost_crypto_data_req *vc_req,\n \t\t\twb_data->next = NULL;\n \t}\n \n-\tif (unlikely(*nb_descs == 0))\n+\tif (unlikely(desc - head_desc == (int)max_n_descs))\n \t\t*cur_desc = NULL;\n-\telse {\n-\t\tif (unlikely(desc->next >= vq_size))\n-\t\t\tgoto error_exit;\n-\t\t*cur_desc = &vc_req->head[desc->next];\n-\t}\n+\telse\n+\t\t*cur_desc = desc + 1;\n \n \t*end_wb_data = wb_data;\n \n@@ -851,14 +833,14 @@ vhost_crypto_check_cipher_request(struct virtio_crypto_cipher_data_req *req)\n \treturn VIRTIO_CRYPTO_BADMSG;\n }\n \n-static uint8_t\n+static __rte_always_inline uint8_t\n prepare_sym_cipher_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\tstruct vhost_crypto_data_req *vc_req,\n \t\tstruct virtio_crypto_cipher_data_req *cipher,\n-\t\tstruct vring_desc *cur_desc,\n-\t\tuint32_t *nb_descs, uint32_t vq_size)\n+\t\tstruct vhost_crypto_desc *head,\n+\t\tuint32_t max_n_descs)\n {\n-\tstruct vring_desc *desc = cur_desc;\n+\tstruct vhost_crypto_desc *desc = head;\n \tstruct vhost_crypto_writeback_data *ewb = NULL;\n \tstruct rte_mbuf *m_src = op->sym->m_src, *m_dst = op->sym->m_dst;\n \tuint8_t *iv_data = rte_crypto_op_ctod_offset(op, uint8_t *, IV_OFFSET);\n@@ -869,8 +851,8 @@ prepare_sym_cipher_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \n \t/* prepare */\n \t/* iv */\n-\tif (unlikely(copy_data(iv_data, vc_req, &desc, cipher->para.iv_len,\n-\t\t\tnb_descs, vq_size) < 0)) {\n+\tif (unlikely(copy_data(iv_data, vc_req, head, &desc,\n+\t\t\tcipher->para.iv_len, max_n_descs))) {\n \t\tret = VIRTIO_CRYPTO_BADMSG;\n \t\tgoto error_exit;\n \t}\n@@ -888,9 +870,8 @@ prepare_sym_cipher_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\t\tgoto error_exit;\n \t\t}\n \n-\t\tif (unlikely(move_desc(vc_req->head, &desc,\n-\t\t\t\tcipher->para.src_data_len, nb_descs,\n-\t\t\t\tvq_size) < 0)) {\n+\t\tif (unlikely(move_desc(head, &desc, cipher->para.src_data_len,\n+\t\t\t\tmax_n_descs) < 0)) {\n \t\t\tVC_LOG_ERR(\"Incorrect descriptor\");\n \t\t\tret = VIRTIO_CRYPTO_ERR;\n \t\t\tgoto error_exit;\n@@ -901,8 +882,8 @@ prepare_sym_cipher_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\tvc_req->wb_pool = vcrypto->wb_pool;\n \t\tm_src->data_len = cipher->para.src_data_len;\n \t\tif (unlikely(copy_data(rte_pktmbuf_mtod(m_src, uint8_t *),\n-\t\t\t\tvc_req, &desc, cipher->para.src_data_len,\n-\t\t\t\tnb_descs, vq_size) < 0)) {\n+\t\t\t\tvc_req, head, &desc, cipher->para.src_data_len,\n+\t\t\t\tmax_n_descs) < 0)) {\n \t\t\tret = VIRTIO_CRYPTO_BADMSG;\n \t\t\tgoto error_exit;\n \t\t}\n@@ -913,7 +894,7 @@ prepare_sym_cipher_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t}\n \n \t/* dst */\n-\tdesc = find_write_desc(vc_req->head, desc, nb_descs, vq_size);\n+\tdesc = find_write_desc(head, desc, max_n_descs);\n \tif (unlikely(!desc)) {\n \t\tVC_LOG_ERR(\"Cannot find write location\");\n \t\tret = VIRTIO_CRYPTO_BADMSG;\n@@ -931,9 +912,8 @@ prepare_sym_cipher_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\t\tgoto error_exit;\n \t\t}\n \n-\t\tif (unlikely(move_desc(vc_req->head, &desc,\n-\t\t\t\tcipher->para.dst_data_len,\n-\t\t\t\tnb_descs, vq_size) < 0)) {\n+\t\tif (unlikely(move_desc(head, &desc, cipher->para.dst_data_len,\n+\t\t\t\tmax_n_descs) < 0)) {\n \t\t\tVC_LOG_ERR(\"Incorrect descriptor\");\n \t\t\tret = VIRTIO_CRYPTO_ERR;\n \t\t\tgoto error_exit;\n@@ -942,9 +922,9 @@ prepare_sym_cipher_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\tm_dst->data_len = cipher->para.dst_data_len;\n \t\tbreak;\n \tcase RTE_VHOST_CRYPTO_ZERO_COPY_DISABLE:\n-\t\tvc_req->wb = prepare_write_back_data(vc_req, &desc, &ewb,\n+\t\tvc_req->wb = prepare_write_back_data(vc_req, head, &desc, &ewb,\n \t\t\t\trte_pktmbuf_mtod(m_src, uint8_t *), 0,\n-\t\t\t\tcipher->para.dst_data_len, nb_descs, vq_size);\n+\t\t\t\tcipher->para.dst_data_len, max_n_descs);\n \t\tif (unlikely(vc_req->wb == NULL)) {\n \t\t\tret = VIRTIO_CRYPTO_ERR;\n \t\t\tgoto error_exit;\n@@ -986,33 +966,33 @@ static __rte_always_inline uint8_t\n vhost_crypto_check_chain_request(struct virtio_crypto_alg_chain_data_req *req)\n {\n \tif (likely((req->para.iv_len <= VHOST_CRYPTO_MAX_IV_LEN) &&\n-\t\t(req->para.src_data_len <= RTE_MBUF_DEFAULT_DATAROOM) &&\n+\t\t(req->para.src_data_len <= VHOST_CRYPTO_MAX_DATA_SIZE) &&\n \t\t(req->para.dst_data_len >= req->para.src_data_len) &&\n-\t\t(req->para.dst_data_len <= RTE_MBUF_DEFAULT_DATAROOM) &&\n+\t\t(req->para.dst_data_len <= VHOST_CRYPTO_MAX_DATA_SIZE) &&\n \t\t(req->para.cipher_start_src_offset <\n-\t\t\tRTE_MBUF_DEFAULT_DATAROOM) &&\n-\t\t(req->para.len_to_cipher < RTE_MBUF_DEFAULT_DATAROOM) &&\n+\t\t\tVHOST_CRYPTO_MAX_DATA_SIZE) &&\n+\t\t(req->para.len_to_cipher <= VHOST_CRYPTO_MAX_DATA_SIZE) &&\n \t\t(req->para.hash_start_src_offset <\n-\t\t\tRTE_MBUF_DEFAULT_DATAROOM) &&\n-\t\t(req->para.len_to_hash < RTE_MBUF_DEFAULT_DATAROOM) &&\n+\t\t\tVHOST_CRYPTO_MAX_DATA_SIZE) &&\n+\t\t(req->para.len_to_hash <= VHOST_CRYPTO_MAX_DATA_SIZE) &&\n \t\t(req->para.cipher_start_src_offset + req->para.len_to_cipher <=\n \t\t\treq->para.src_data_len) &&\n \t\t(req->para.hash_start_src_offset + req->para.len_to_hash <=\n \t\t\treq->para.src_data_len) &&\n \t\t(req->para.dst_data_len + req->para.hash_result_len <=\n-\t\t\tRTE_MBUF_DEFAULT_DATAROOM)))\n+\t\t\tVHOST_CRYPTO_MAX_DATA_SIZE)))\n \t\treturn VIRTIO_CRYPTO_OK;\n \treturn VIRTIO_CRYPTO_BADMSG;\n }\n \n-static uint8_t\n+static __rte_always_inline uint8_t\n prepare_sym_chain_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\tstruct vhost_crypto_data_req *vc_req,\n \t\tstruct virtio_crypto_alg_chain_data_req *chain,\n-\t\tstruct vring_desc *cur_desc,\n-\t\tuint32_t *nb_descs, uint32_t vq_size)\n+\t\tstruct vhost_crypto_desc *head,\n+\t\tuint32_t max_n_descs)\n {\n-\tstruct vring_desc *desc = cur_desc, *digest_desc;\n+\tstruct vhost_crypto_desc *desc = head, *digest_desc;\n \tstruct vhost_crypto_writeback_data *ewb = NULL, *ewb2 = NULL;\n \tstruct rte_mbuf *m_src = op->sym->m_src, *m_dst = op->sym->m_dst;\n \tuint8_t *iv_data = rte_crypto_op_ctod_offset(op, uint8_t *, IV_OFFSET);\n@@ -1025,8 +1005,8 @@ prepare_sym_chain_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \n \t/* prepare */\n \t/* iv */\n-\tif (unlikely(copy_data(iv_data, vc_req, &desc,\n-\t\t\tchain->para.iv_len, nb_descs, vq_size) < 0)) {\n+\tif (unlikely(copy_data(iv_data, vc_req, head, &desc,\n+\t\t\tchain->para.iv_len, max_n_descs) < 0)) {\n \t\tret = VIRTIO_CRYPTO_BADMSG;\n \t\tgoto error_exit;\n \t}\n@@ -1045,9 +1025,8 @@ prepare_sym_chain_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\t\tgoto error_exit;\n \t\t}\n \n-\t\tif (unlikely(move_desc(vc_req->head, &desc,\n-\t\t\t\tchain->para.src_data_len,\n-\t\t\t\tnb_descs, vq_size) < 0)) {\n+\t\tif (unlikely(move_desc(head, &desc, chain->para.src_data_len,\n+\t\t\t\tmax_n_descs) < 0)) {\n \t\t\tVC_LOG_ERR(\"Incorrect descriptor\");\n \t\t\tret = VIRTIO_CRYPTO_ERR;\n \t\t\tgoto error_exit;\n@@ -1057,8 +1036,8 @@ prepare_sym_chain_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\tvc_req->wb_pool = vcrypto->wb_pool;\n \t\tm_src->data_len = chain->para.src_data_len;\n \t\tif (unlikely(copy_data(rte_pktmbuf_mtod(m_src, uint8_t *),\n-\t\t\t\tvc_req, &desc, chain->para.src_data_len,\n-\t\t\t\tnb_descs, vq_size) < 0)) {\n+\t\t\t\tvc_req, head, &desc, chain->para.src_data_len,\n+\t\t\t\tmax_n_descs) < 0)) {\n \t\t\tret = VIRTIO_CRYPTO_BADMSG;\n \t\t\tgoto error_exit;\n \t\t}\n@@ -1070,7 +1049,7 @@ prepare_sym_chain_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t}\n \n \t/* dst */\n-\tdesc = find_write_desc(vc_req->head, desc, nb_descs, vq_size);\n+\tdesc = find_write_desc(head, desc, max_n_descs);\n \tif (unlikely(!desc)) {\n \t\tVC_LOG_ERR(\"Cannot find write location\");\n \t\tret = VIRTIO_CRYPTO_BADMSG;\n@@ -1089,8 +1068,7 @@ prepare_sym_chain_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\t}\n \n \t\tif (unlikely(move_desc(vc_req->head, &desc,\n-\t\t\t\tchain->para.dst_data_len,\n-\t\t\t\tnb_descs, vq_size) < 0)) {\n+\t\t\t\tchain->para.dst_data_len, max_n_descs) < 0)) {\n \t\t\tVC_LOG_ERR(\"Incorrect descriptor\");\n \t\t\tret = VIRTIO_CRYPTO_ERR;\n \t\t\tgoto error_exit;\n@@ -1106,9 +1084,9 @@ prepare_sym_chain_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \t\t\tgoto error_exit;\n \t\t}\n \n-\t\tif (unlikely(move_desc(vc_req->head, &desc,\n+\t\tif (unlikely(move_desc(head, &desc,\n \t\t\t\tchain->para.hash_result_len,\n-\t\t\t\tnb_descs, vq_size) < 0)) {\n+\t\t\t\tmax_n_descs) < 0)) {\n \t\t\tVC_LOG_ERR(\"Incorrect descriptor\");\n \t\t\tret = VIRTIO_CRYPTO_ERR;\n \t\t\tgoto error_exit;\n@@ -1116,34 +1094,34 @@ prepare_sym_chain_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n \n \t\tbreak;\n \tcase RTE_VHOST_CRYPTO_ZERO_COPY_DISABLE:\n-\t\tvc_req->wb = prepare_write_back_data(vc_req, &desc, &ewb,\n+\t\tvc_req->wb = prepare_write_back_data(vc_req, head, &desc, &ewb,\n \t\t\t\trte_pktmbuf_mtod(m_src, uint8_t *),\n \t\t\t\tchain->para.cipher_start_src_offset,\n \t\t\t\tchain->para.dst_data_len -\n-\t\t\t\tchain->para.cipher_start_src_offset,\n-\t\t\t\tnb_descs, vq_size);\n+\t\t\t\t\tchain->para.cipher_start_src_offset,\n+\t\t\t\tmax_n_descs);\n \t\tif (unlikely(vc_req->wb == NULL)) {\n \t\t\tret = VIRTIO_CRYPTO_ERR;\n \t\t\tgoto error_exit;\n \t\t}\n \n+\t\tdigest_desc = desc;\n \t\tdigest_offset = m_src->data_len;\n \t\tdigest_addr = rte_pktmbuf_mtod_offset(m_src, void *,\n \t\t\t\tdigest_offset);\n-\t\tdigest_desc = desc;\n \n \t\t/** create a wb_data for digest */\n-\t\tewb->next = prepare_write_back_data(vc_req, &desc, &ewb2,\n-\t\t\t\tdigest_addr, 0, chain->para.hash_result_len,\n-\t\t\t\tnb_descs, vq_size);\n+\t\tewb->next = prepare_write_back_data(vc_req, head, &desc,\n+\t\t\t\t&ewb2, digest_addr, 0,\n+\t\t\t\tchain->para.hash_result_len, max_n_descs);\n \t\tif (unlikely(ewb->next == NULL)) {\n \t\t\tret = VIRTIO_CRYPTO_ERR;\n \t\t\tgoto error_exit;\n \t\t}\n \n-\t\tif (unlikely(copy_data(digest_addr, vc_req, &digest_desc,\n+\t\tif (unlikely(copy_data(digest_addr, vc_req, head, &digest_desc,\n \t\t\t\tchain->para.hash_result_len,\n-\t\t\t\tnb_descs, vq_size) < 0)) {\n+\t\t\t\tmax_n_descs) < 0)) {\n \t\t\tret = VIRTIO_CRYPTO_BADMSG;\n \t\t\tgoto error_exit;\n \t\t}\n@@ -1193,74 +1171,103 @@ prepare_sym_chain_op(struct vhost_crypto *vcrypto, struct rte_crypto_op *op,\n static __rte_always_inline int\n vhost_crypto_process_one_req(struct vhost_crypto *vcrypto,\n \t\tstruct vhost_virtqueue *vq, struct rte_crypto_op *op,\n-\t\tstruct vring_desc *head, uint16_t desc_idx)\n+\t\tstruct vring_desc *head, struct vhost_crypto_desc *descs,\n+\t\tuint16_t desc_idx)\n {\n \tstruct vhost_crypto_data_req *vc_req = rte_mbuf_to_priv(op->sym->m_src);\n \tstruct rte_cryptodev_sym_session *session;\n-\tstruct virtio_crypto_op_data_req *req, tmp_req;\n+\tstruct virtio_crypto_op_data_req req;\n \tstruct virtio_crypto_inhdr *inhdr;\n-\tstruct vring_desc *desc = NULL;\n+\tstruct vhost_crypto_desc *desc = descs;\n+\tstruct vring_desc *src_desc;\n \tuint64_t session_id;\n \tuint64_t dlen;\n-\tuint32_t nb_descs = vq->size;\n-\tint err = 0;\n+\tuint32_t nb_descs = 0, max_n_descs, i;\n+\tint err;\n \n \tvc_req->desc_idx = desc_idx;\n \tvc_req->dev = vcrypto->dev;\n \tvc_req->vq = vq;\n \n-\tif (likely(head->flags & VRING_DESC_F_INDIRECT)) {\n-\t\tdlen = head->len;\n-\t\tnb_descs = dlen / sizeof(struct vring_desc);\n-\t\t/* drop invalid descriptors */\n-\t\tif (unlikely(nb_descs > vq->size))\n-\t\t\treturn -1;\n-\t\tdesc = IOVA_TO_VVA(struct vring_desc *, vc_req, head->addr,\n-\t\t\t\t&dlen, VHOST_ACCESS_RO);\n-\t\tif (unlikely(!desc || dlen != head->len))\n-\t\t\treturn -1;\n-\t\tdesc_idx = 0;\n-\t\thead = desc;\n-\t} else {\n-\t\tdesc = head;\n+\tif (unlikely((head->flags & VRING_DESC_F_INDIRECT) == 0)) {\n+\t\tVC_LOG_ERR(\"Invalid descriptor\");\n+\t\treturn -1;\n \t}\n \n-\tvc_req->head = head;\n-\tvc_req->zero_copy = vcrypto->option;\n+\tdlen = head->len;\n+\tsrc_desc = IOVA_TO_VVA(struct vring_desc *, vc_req, head->addr,\n+\t\t\t&dlen, VHOST_ACCESS_RO);\n+\tif (unlikely(!src_desc || dlen != head->len)) {\n+\t\tVC_LOG_ERR(\"Invalid descriptor\");\n+\t\treturn -1;\n+\t}\n+\thead = src_desc;\n \n-\treq = get_data_ptr(vc_req, desc, VHOST_ACCESS_RO);\n-\tif (unlikely(req == NULL)) {\n-\t\tswitch (vcrypto->option) {\n-\t\tcase RTE_VHOST_CRYPTO_ZERO_COPY_ENABLE:\n-\t\t\terr = VIRTIO_CRYPTO_BADMSG;\n-\t\t\tVC_LOG_ERR(\"Invalid descriptor\");\n-\t\t\tgoto error_exit;\n-\t\tcase RTE_VHOST_CRYPTO_ZERO_COPY_DISABLE:\n-\t\t\treq = &tmp_req;\n-\t\t\tif (unlikely(copy_data(req, vc_req, &desc, sizeof(*req),\n-\t\t\t\t\t&nb_descs, vq->size) < 0)) {\n-\t\t\t\terr = VIRTIO_CRYPTO_BADMSG;\n-\t\t\t\tVC_LOG_ERR(\"Invalid descriptor\");\n-\t\t\t\tgoto error_exit;\n+\tnb_descs = max_n_descs = dlen / sizeof(struct vring_desc);\n+\tif (unlikely(nb_descs > VHOST_CRYPTO_MAX_N_DESC || nb_descs == 0)) {\n+\t\terr = VIRTIO_CRYPTO_ERR;\n+\t\tVC_LOG_ERR(\"Cannot process num of descriptors %u\", nb_descs);\n+\t\tif (nb_descs > 0) {\n+\t\t\tstruct vring_desc *inhdr_desc = head;\n+\t\t\twhile (inhdr_desc->flags & VRING_DESC_F_NEXT) {\n+\t\t\t\tif (inhdr_desc->next >= max_n_descs)\n+\t\t\t\t\treturn -1;\n+\t\t\t\tinhdr_desc = &head[inhdr_desc->next];\n \t\t\t}\n-\t\t\tbreak;\n-\t\tdefault:\n-\t\t\terr = VIRTIO_CRYPTO_ERR;\n-\t\t\tVC_LOG_ERR(\"Invalid option\");\n-\t\t\tgoto error_exit;\n+\t\t\tif (inhdr_desc->len != sizeof(*inhdr))\n+\t\t\t\treturn -1;\n+\t\t\tinhdr = IOVA_TO_VVA(struct virtio_crypto_inhdr *,\n+\t\t\t\t\tvc_req, inhdr_desc->addr, &dlen,\n+\t\t\t\t\tVHOST_ACCESS_WO);\n+\t\t\tif (unlikely(!inhdr || dlen != inhdr_desc->len))\n+\t\t\t\treturn -1;\n+\t\t\tinhdr->status = VIRTIO_CRYPTO_ERR;\n+\t\t\treturn -1;\n \t\t}\n-\t} else {\n-\t\tif (unlikely(move_desc(vc_req->head, &desc,\n-\t\t\t\tsizeof(*req), &nb_descs, vq->size) < 0)) {\n-\t\t\tVC_LOG_ERR(\"Incorrect descriptor\");\n+\t}\n+\n+\t/* copy descriptors to local variable */\n+\tfor (i = 0; i < max_n_descs; i++) {\n+\t\tdesc->addr = src_desc->addr;\n+\t\tdesc->len = src_desc->len;\n+\t\tdesc->flags = src_desc->flags;\n+\t\tdesc++;\n+\t\tif (unlikely((src_desc->flags & VRING_DESC_F_NEXT) == 0))\n+\t\t\tbreak;\n+\t\tif (unlikely(src_desc->next >= max_n_descs)) {\n+\t\t\terr = VIRTIO_CRYPTO_BADMSG;\n+\t\t\tVC_LOG_ERR(\"Invalid descriptor\");\n \t\t\tgoto error_exit;\n \t\t}\n+\t\tsrc_desc = &head[src_desc->next];\n+\t}\n+\n+\tvc_req->head = head;\n+\tvc_req->zero_copy = vcrypto->option;\n+\n+\tnb_descs = desc - descs;\n+\tdesc = descs;\n+\n+\tif (unlikely(desc->len < sizeof(req))) {\n+\t\terr = VIRTIO_CRYPTO_BADMSG;\n+\t\tVC_LOG_ERR(\"Invalid descriptor\");\n+\t\tgoto error_exit;\n \t}\n \n-\tswitch (req->header.opcode) {\n+\tif (unlikely(copy_data(&req, vc_req, descs, &desc, sizeof(req),\n+\t\t\tmax_n_descs) < 0)) {\n+\t\terr = VIRTIO_CRYPTO_BADMSG;\n+\t\tVC_LOG_ERR(\"Invalid descriptor\");\n+\t\tgoto error_exit;\n+\t}\n+\n+\t/* desc is advanced by 1 now */\n+\tmax_n_descs -= 1;\n+\n+\tswitch (req.header.opcode) {\n \tcase VIRTIO_CRYPTO_CIPHER_ENCRYPT:\n \tcase VIRTIO_CRYPTO_CIPHER_DECRYPT:\n-\t\tsession_id = req->header.session_id;\n+\t\tsession_id = req.header.session_id;\n \n \t\t/* one branch to avoid unnecessary table lookup */\n \t\tif (vcrypto->cache_session_id != session_id) {\n@@ -1286,19 +1293,19 @@ vhost_crypto_process_one_req(struct vhost_crypto *vcrypto,\n \t\t\tgoto error_exit;\n \t\t}\n \n-\t\tswitch (req->u.sym_req.op_type) {\n+\t\tswitch (req.u.sym_req.op_type) {\n \t\tcase VIRTIO_CRYPTO_SYM_OP_NONE:\n \t\t\terr = VIRTIO_CRYPTO_NOTSUPP;\n \t\t\tbreak;\n \t\tcase VIRTIO_CRYPTO_SYM_OP_CIPHER:\n \t\t\terr = prepare_sym_cipher_op(vcrypto, op, vc_req,\n-\t\t\t\t\t&req->u.sym_req.u.cipher, desc,\n-\t\t\t\t\t&nb_descs, vq->size);\n+\t\t\t\t\t&req.u.sym_req.u.cipher, desc,\n+\t\t\t\t\tmax_n_descs);\n \t\t\tbreak;\n \t\tcase VIRTIO_CRYPTO_SYM_OP_ALGORITHM_CHAINING:\n \t\t\terr = prepare_sym_chain_op(vcrypto, op, vc_req,\n-\t\t\t\t\t&req->u.sym_req.u.chain, desc,\n-\t\t\t\t\t&nb_descs, vq->size);\n+\t\t\t\t\t&req.u.sym_req.u.chain, desc,\n+\t\t\t\t\tmax_n_descs);\n \t\t\tbreak;\n \t\t}\n \t\tif (unlikely(err != 0)) {\n@@ -1307,8 +1314,9 @@ vhost_crypto_process_one_req(struct vhost_crypto *vcrypto,\n \t\t}\n \t\tbreak;\n \tdefault:\n+\t\terr = VIRTIO_CRYPTO_ERR;\n \t\tVC_LOG_ERR(\"Unsupported symmetric crypto request type %u\",\n-\t\t\t\treq->header.opcode);\n+\t\t\t\treq.header.opcode);\n \t\tgoto error_exit;\n \t}\n \n@@ -1316,7 +1324,7 @@ vhost_crypto_process_one_req(struct vhost_crypto *vcrypto,\n \n error_exit:\n \n-\tinhdr = reach_inhdr(vc_req, desc, &nb_descs, vq->size);\n+\tinhdr = reach_inhdr(vc_req, descs, max_n_descs);\n \tif (likely(inhdr != NULL))\n \t\tinhdr->status = (uint8_t)err;\n \n@@ -1330,17 +1338,16 @@ vhost_crypto_finalize_one_request(struct rte_crypto_op *op,\n \tstruct rte_mbuf *m_src = op->sym->m_src;\n \tstruct rte_mbuf *m_dst = op->sym->m_dst;\n \tstruct vhost_crypto_data_req *vc_req = rte_mbuf_to_priv(m_src);\n-\tuint16_t desc_idx;\n+\tstruct vhost_virtqueue *vq = vc_req->vq;\n+\tuint16_t used_idx = vc_req->desc_idx, desc_idx;\n \n \tif (unlikely(!vc_req)) {\n \t\tVC_LOG_ERR(\"Failed to retrieve vc_req\");\n \t\treturn NULL;\n \t}\n \n-\tif (old_vq && (vc_req->vq != old_vq))\n-\t\treturn vc_req->vq;\n-\n-\tdesc_idx = vc_req->desc_idx;\n+\tif (old_vq && (vq != old_vq))\n+\t\treturn vq;\n \n \tif (unlikely(op->status != RTE_CRYPTO_OP_STATUS_SUCCESS))\n \t\tvc_req->inhdr->status = VIRTIO_CRYPTO_ERR;\n@@ -1349,8 +1356,9 @@ vhost_crypto_finalize_one_request(struct rte_crypto_op *op,\n \t\t\twrite_back_data(vc_req);\n \t}\n \n-\tvc_req->vq->used->ring[desc_idx].id = desc_idx;\n-\tvc_req->vq->used->ring[desc_idx].len = vc_req->len;\n+\tdesc_idx = vq->avail->ring[used_idx];\n+\tvq->used->ring[desc_idx].id = vq->avail->ring[desc_idx];\n+\tvq->used->ring[desc_idx].len = vc_req->len;\n \n \trte_mempool_put(m_src->pool, (void *)m_src);\n \n@@ -1448,7 +1456,7 @@ rte_vhost_crypto_create(int vid, uint8_t cryptodev_id,\n \tvcrypto->mbuf_pool = rte_pktmbuf_pool_create(name,\n \t\t\tVHOST_CRYPTO_MBUF_POOL_SIZE, 512,\n \t\t\tsizeof(struct vhost_crypto_data_req),\n-\t\t\tRTE_MBUF_DEFAULT_DATAROOM * 2 + RTE_PKTMBUF_HEADROOM,\n+\t\t\tVHOST_CRYPTO_MAX_DATA_SIZE + RTE_PKTMBUF_HEADROOM,\n \t\t\trte_socket_id());\n \tif (!vcrypto->mbuf_pool) {\n \t\tVC_LOG_ERR(\"Failed to creath mbuf pool\");\n@@ -1574,6 +1582,7 @@ rte_vhost_crypto_fetch_requests(int vid, uint32_t qid,\n \t\tstruct rte_crypto_op **ops, uint16_t nb_ops)\n {\n \tstruct rte_mbuf *mbufs[VHOST_CRYPTO_MAX_BURST_SIZE * 2];\n+\tstruct vhost_crypto_desc descs[VHOST_CRYPTO_MAX_N_DESC];\n \tstruct virtio_net *dev = get_device(vid);\n \tstruct vhost_crypto *vcrypto;\n \tstruct vhost_virtqueue *vq;\n@@ -1632,7 +1641,7 @@ rte_vhost_crypto_fetch_requests(int vid, uint32_t qid,\n \t\t\top->sym->m_dst->data_off = 0;\n \n \t\t\tif (unlikely(vhost_crypto_process_one_req(vcrypto, vq,\n-\t\t\t\t\top, head, desc_idx) < 0))\n+\t\t\t\t\top, head, descs, used_idx) < 0))\n \t\t\t\tbreak;\n \t\t}\n \n@@ -1661,7 +1670,7 @@ rte_vhost_crypto_fetch_requests(int vid, uint32_t qid,\n \t\t\top->sym->m_src->data_off = 0;\n \n \t\t\tif (unlikely(vhost_crypto_process_one_req(vcrypto, vq,\n-\t\t\t\t\top, head, desc_idx) < 0))\n+\t\t\t\t\top, head, descs, desc_idx) < 0))\n \t\t\t\tbreak;\n \t\t}\n \n",
    "prefixes": [
        "6/6"
    ]
}