vhost-net: update used ring on backend change

On backend change, we flushed out outstanding skbs
but forgot to update the used ring, so that
done entries were left in the ubuf_info ring.
As a result we lose heads or complete incorrect ones,
crashing the guest or leaking memory.
Fix by updating the used ring.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

1 files changed, 5 insertions, 1 deletions

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 70ac60437d17..248b25008d1a 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -711,8 +711,12 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
 
         mutex_unlock(&vq->mutex);
 
-        if (oldubufs)
+        if (oldubufs) {
                 vhost_ubuf_put_and_wait(oldubufs);
+                mutex_lock(&vq->mutex);
+                vhost_zerocopy_signal_used(vq);
+                mutex_unlock(&vq->mutex);
+        }
 
         if (oldsock) {
                 vhost_net_flush_vq(n, index);