From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
kvm@vger.kernel.org, "Michael S . Tsirkin" <mst@redhat.com>,
netdev@vger.kernel.org,
virtualization@lists.linux-foundation.org,
Neeraj Upadhyay <neeraju@codeaurora.org>
Subject: [PATCH AUTOSEL 5.4 04/10] vringh: Use wiov->used to check for read/write desc order
Date: Mon, 23 Aug 2021 20:54:51 -0400 [thread overview]
Message-ID: <20210824005458.631377-4-sashal@kernel.org> (raw)
In-Reply-To: <20210824005458.631377-1-sashal@kernel.org>
From: Neeraj Upadhyay <neeraju@codeaurora.org>
[ Upstream commit e74cfa91f42c50f7f649b0eca46aa049754ccdbd ]
As __vringh_iov() traverses a descriptor chain, it populates
each descriptor entry into either read or write vring iov
and increments that iov's ->used member. So, as we iterate
over a descriptor chain, at any point, (riov/wriov)->used
value gives the number of descriptor enteries available,
which are to be read or written by the device. As all read
iovs must precede the write iovs, wiov->used should be zero
when we are traversing a read descriptor. Current code checks
for wiov->i, to figure out whether any previous entry in the
current descriptor chain was a write descriptor. However,
iov->i is only incremented, when these vring iovs are consumed,
at a later point, and remain 0 in __vringh_iov(). So, correct
the check for read and write descriptor order, to use
wiov->used.
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Link: https://lore.kernel.org/r/1624591502-4827-1-git-send-email-neeraju@codeaurora.org
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/vringh.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 026a37ee4177..4653de001e26 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -331,7 +331,7 @@ __vringh_iov(struct vringh *vrh, u16 i,
iov = wiov;
else {
iov = riov;
- if (unlikely(wiov && wiov->i)) {
+ if (unlikely(wiov && wiov->used)) {
vringh_bad("Readable desc %p after writable",
&descs[i]);
err = -EINVAL;
--
2.30.2
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Neeraj Upadhyay <neeraju@codeaurora.org>,
Jason Wang <jasowang@redhat.com>,
Stefano Garzarella <sgarzare@redhat.com>,
"Michael S . Tsirkin" <mst@redhat.com>,
Sasha Levin <sashal@kernel.org>,
kvm@vger.kernel.org, virtualization@lists.linux-foundation.org,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 04/10] vringh: Use wiov->used to check for read/write desc order
Date: Mon, 23 Aug 2021 20:54:51 -0400 [thread overview]
Message-ID: <20210824005458.631377-4-sashal@kernel.org> (raw)
In-Reply-To: <20210824005458.631377-1-sashal@kernel.org>
From: Neeraj Upadhyay <neeraju@codeaurora.org>
[ Upstream commit e74cfa91f42c50f7f649b0eca46aa049754ccdbd ]
As __vringh_iov() traverses a descriptor chain, it populates
each descriptor entry into either read or write vring iov
and increments that iov's ->used member. So, as we iterate
over a descriptor chain, at any point, (riov/wriov)->used
value gives the number of descriptor enteries available,
which are to be read or written by the device. As all read
iovs must precede the write iovs, wiov->used should be zero
when we are traversing a read descriptor. Current code checks
for wiov->i, to figure out whether any previous entry in the
current descriptor chain was a write descriptor. However,
iov->i is only incremented, when these vring iovs are consumed,
at a later point, and remain 0 in __vringh_iov(). So, correct
the check for read and write descriptor order, to use
wiov->used.
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Link: https://lore.kernel.org/r/1624591502-4827-1-git-send-email-neeraju@codeaurora.org
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/vringh.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index 026a37ee4177..4653de001e26 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -331,7 +331,7 @@ __vringh_iov(struct vringh *vrh, u16 i,
iov = wiov;
else {
iov = riov;
- if (unlikely(wiov && wiov->i)) {
+ if (unlikely(wiov && wiov->used)) {
vringh_bad("Readable desc %p after writable",
&descs[i]);
err = -EINVAL;
--
2.30.2
next prev parent reply other threads:[~2021-08-24 0:55 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-24 0:54 [PATCH AUTOSEL 5.4 01/10] opp: remove WARN when no valid OPPs remain Sasha Levin
2021-08-24 0:54 ` [PATCH AUTOSEL 5.4 02/10] virtio: Improve vq->broken access to avoid any compiler optimization Sasha Levin
2021-08-24 0:54 ` Sasha Levin
2021-08-24 0:54 ` [PATCH AUTOSEL 5.4 03/10] virtio_pci: Support surprise removal of virtio pci device Sasha Levin
2021-08-24 0:54 ` Sasha Levin
2021-08-24 0:54 ` Sasha Levin [this message]
2021-08-24 0:54 ` [PATCH AUTOSEL 5.4 04/10] vringh: Use wiov->used to check for read/write desc order Sasha Levin
2021-08-24 0:54 ` [PATCH AUTOSEL 5.4 05/10] qed: qed ll2 race condition fixes Sasha Levin
2021-08-24 0:54 ` [PATCH AUTOSEL 5.4 06/10] qed: Fix null-pointer dereference in qed_rdma_create_qp() Sasha Levin
2021-08-24 0:54 ` [PATCH AUTOSEL 5.4 07/10] drm: Copy drm_wait_vblank to user before returning Sasha Levin
2021-08-24 0:54 ` [Nouveau] [PATCH AUTOSEL 5.4 08/10] drm/nouveau/disp: power down unused DP links during init Sasha Levin
2021-08-24 0:54 ` Sasha Levin
2021-08-24 0:54 ` [Nouveau] [PATCH AUTOSEL 5.4 09/10] drm/nouveau: block a bunch of classes from userspace Sasha Levin
2021-08-24 0:54 ` Sasha Levin
2021-08-24 0:54 ` [PATCH AUTOSEL 5.4 10/10] net/rds: dma_map_sg is entitled to merge entries Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210824005458.631377-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mst@redhat.com \
--cc=neeraju@codeaurora.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=virtualization@lists.linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.