From 816e85edff0f31bc8e4614eaaf9a0364406d7a8f Mon Sep 17 00:00:00 2001 From: Byungchul Park Date: Thu, 9 Nov 2017 09:00:21 +0900 Subject: vhost/scsi: Use safe iteration in vhost_scsi_complete_cmd_work() The following patch changed the behavior which originally did safe iteration. Make it safe as it was. 12bdcbd539c6327c09da0503c674733cb2d82cb5 vhost/scsi: Don't reinvent the wheel but use existing llist API Signed-off-by: Byungchul Park Signed-off-by: Michael S. Tsirkin --- drivers/vhost/scsi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/vhost') diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 046f6d280af5..46539ca6ca86 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -519,7 +519,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) vs_completion_work); DECLARE_BITMAP(signal, VHOST_SCSI_MAX_VQ); struct virtio_scsi_cmd_resp v_rsp; - struct vhost_scsi_cmd *cmd; + struct vhost_scsi_cmd *cmd, *t; struct llist_node *llnode; struct se_cmd *se_cmd; struct iov_iter iov_iter; @@ -527,7 +527,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) bitmap_zero(signal, VHOST_SCSI_MAX_VQ); llnode = llist_del_all(&vs->vs_completion_list); - llist_for_each_entry(cmd, llnode, tvc_completion_list) { + llist_for_each_entry_safe(cmd, t, llnode, tvc_completion_list) { se_cmd = &cmd->tvc_se_cmd; pr_debug("%s tv_cmd %p resid %u status %#02x\n", __func__, -- cgit v1.2.3 From ca2c5b33a285723f517fa296b76f7fd36c383dad Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" Date: Mon, 21 Aug 2017 22:33:33 +0300 Subject: vhost: fix end of range for access_ok During access_ok checks, addr increases as we iterate over the data structure, thus addr + len - 1 will point beyond the end of region we are translating. Harmless since we then verify that the region covers addr, but let's not waste cpu cycles. Reported-by: Koichiro Den Signed-off-by: Michael S. Tsirkin Acked-by: Koichiro Den --- drivers/vhost/vhost.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/vhost') diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index d6dbb28245e6..33ac2b186b85 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1175,7 +1175,7 @@ static int iotlb_access_ok(struct vhost_virtqueue *vq, { const struct vhost_umem_node *node; struct vhost_umem *umem = vq->iotlb; - u64 s = 0, size, orig_addr = addr; + u64 s = 0, size, orig_addr = addr, last = addr + len - 1; if (vhost_vq_meta_fetch(vq, addr, len, type)) return true; @@ -1183,7 +1183,7 @@ static int iotlb_access_ok(struct vhost_virtqueue *vq, while (len > s) { node = vhost_umem_interval_tree_iter_first(&umem->umem_tree, addr, - addr + len - 1); + last); if (node == NULL || node->start > addr) { vhost_iotlb_miss(vq, addr, access); return false; -- cgit v1.2.3 From a72b69dc083a931422cc8a5e33841aff7d5312f2 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Thu, 9 Nov 2017 13:29:10 +0000 Subject: vhost/vsock: fix uninitialized vhost_vsock->guest_cid The vhost_vsock->guest_cid field is uninitialized when /dev/vhost-vsock is opened until the VHOST_VSOCK_SET_GUEST_CID ioctl is called. kvmalloc(..., GFP_KERNEL | __GFP_RETRY_MAYFAIL) does not zero memory. All other vhost_vsock fields are initialized explicitly so just initialize this field too. Signed-off-by: Stefan Hajnoczi Signed-off-by: Michael S. Tsirkin --- drivers/vhost/vsock.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/vhost') diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index c9de9c41aa97..5a5e981bd8e4 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -518,6 +518,8 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file) goto out; } + vsock->guest_cid = 0; /* no CID assigned yet */ + atomic_set(&vsock->queued_replies, 0); vqs[VSOCK_VQ_TX] = &vsock->vqs[VSOCK_VQ_TX]; -- cgit v1.2.3