| From foo@baz Sat Apr 14 09:15:32 CEST 2018 |
| From: Stefan Hajnoczi <stefanha@redhat.com> |
| Date: Wed, 11 Apr 2018 10:35:40 +0800 |
| Subject: vhost: fix vhost_vq_access_ok() log check |
| |
| From: Stefan Hajnoczi <stefanha@redhat.com> |
| |
| |
| [ Upstream commit d14d2b78090c7de0557362b26a4ca591aa6a9faa ] |
| |
| Commit d65026c6c62e7d9616c8ceb5a53b68bcdc050525 ("vhost: validate log |
| when IOTLB is enabled") introduced a regression. The logic was |
| originally: |
| |
| if (vq->iotlb) |
| return 1; |
| return A && B; |
| |
| After the patch the short-circuit logic for A was inverted: |
| |
| if (A || vq->iotlb) |
| return A; |
| return B; |
| |
| This patch fixes the regression by rewriting the checks in the obvious |
| way, no longer returning A when vq->iotlb is non-NULL (which is hard to |
| understand). |
| |
| Reported-by: syzbot+65a84dde0214b0387ccd@syzkaller.appspotmail.com |
| Cc: Jason Wang <jasowang@redhat.com> |
| Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> |
| Acked-by: Michael S. Tsirkin <mst@redhat.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/vhost/vhost.c | 8 +++++--- |
| 1 file changed, 5 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/vhost/vhost.c |
| +++ b/drivers/vhost/vhost.c |
| @@ -1244,10 +1244,12 @@ static int vq_log_access_ok(struct vhost |
| /* Caller should have vq mutex and device mutex */ |
| int vhost_vq_access_ok(struct vhost_virtqueue *vq) |
| { |
| - int ret = vq_log_access_ok(vq, vq->log_base); |
| + if (!vq_log_access_ok(vq, vq->log_base)) |
| + return 0; |
| |
| - if (ret || vq->iotlb) |
| - return ret; |
| + /* Access validation occurs at prefetch time with IOTLB */ |
| + if (vq->iotlb) |
| + return 1; |
| |
| return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used); |
| } |