From nobody Thu May 2 00:55:39 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1512151432505630.9573938470829; Fri, 1 Dec 2017 10:03:52 -0800 (PST) Received: from localhost ([::1]:59293 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eKpf9-0001ZS-Kc for importer@patchew.org; Fri, 01 Dec 2017 13:03:47 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47248) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eKoBK-00061A-P2 for qemu-devel@nongnu.org; Fri, 01 Dec 2017 11:28:55 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eKoBF-0005E3-Tb for qemu-devel@nongnu.org; Fri, 01 Dec 2017 11:28:53 -0500 Received: from 14.mo3.mail-out.ovh.net ([188.165.43.98]:55079) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eKoBF-0005DJ-OC for qemu-devel@nongnu.org; Fri, 01 Dec 2017 11:28:49 -0500 Received: from player797.ha.ovh.net (gw6.ovh.net [213.251.189.206]) by mo3.mail-out.ovh.net (Postfix) with ESMTP id B8663177365 for ; Thu, 30 Nov 2017 22:40:12 +0100 (CET) Received: from bahia.lan (gar31-1-82-66-74-139.fbx.proxad.net [82.66.74.139]) (Authenticated sender: groug@kaod.org) by player797.ha.ovh.net (Postfix) with ESMTPA id 44EF12E008E; Thu, 30 Nov 2017 22:40:07 +0100 (CET) From: Greg Kurz To: qemu-devel@nongnu.org Date: Thu, 30 Nov 2017 22:39:59 +0100 Message-ID: <151207799957.10789.15658210433260163179.stgit@bahia.lan> User-Agent: StGit/0.17.1-46-g6855-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Ovh-Tracer-Id: 8843662296719989102 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedtuddrtdeggddutddtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddm X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 188.165.43.98 Subject: [Qemu-devel] [PATCH] vhost: fix error check in vhost_verify_ring_mappings() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Igor Mammedov , qemu-stable@nongnu.org, "Dr. David Alan Gilbert" , "Michael S. Tsirkin" Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Since commit f1f9e6c5 "vhost: adapt vhost_verify_ring_mappings() to virtio 1 ring layout", we check the mapping of each part (descriptor table, available ring and used ring) of each virtqueue separately. The checking of a part is done by the vhost_verify_ring_part_mapping() function: it returns either 0 on success or a negative errno if the part cannot be mapped at the same place. Unfortunately, the vhost_verify_ring_mappings() function checks its return value the other way round. It means that we either: - only verify the descriptor table of the first virtqueue, and if it is valid we ignore all the other mappings - or ignore all broken mappings until we reach a valid one ie, we only raise an error if all mappings are broken, and we consider all mappings are valid otherwise (false success), which is obviously wrong. This patch ensures that vhost_verify_ring_mappings() only returns success if ALL mappings are okay. Reported-by: Dr. David Alan Gilbert Signed-off-by: Greg Kurz --- The issue has been around since 2.8, so I don't think this fix is worth an extra rc round. It can be shipped with 2.11.1. --- hw/virtio/vhost.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index ddc42f0f93ed..6e7d45b01bc8 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -493,21 +493,21 @@ static int vhost_verify_ring_mappings(struct vhost_de= v *dev, j =3D 0; r =3D vhost_verify_ring_part_mapping(dev, vq->desc, vq->desc_phys, vq->desc_size, start_addr, size= ); - if (!r) { + if (r) { break; } =20 j++; r =3D vhost_verify_ring_part_mapping(dev, vq->avail, vq->avail_phy= s, vq->avail_size, start_addr, siz= e); - if (!r) { + if (r) { break; } =20 j++; r =3D vhost_verify_ring_part_mapping(dev, vq->used, vq->used_phys, vq->used_size, start_addr, size= ); - if (!r) { + if (r) { break; } }