lkml.org 
[lkml]   [2019]   [Feb]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.20 071/105] vhost/scsi: Use copy_to_iter() to send control queue response
    Date
    From: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>

    [ Upstream commit 8e5dadfe76cf2862ebf3e4f22adef29982df7766 ]

    Uses copy_to_iter() instead of __copy_to_user() in order to ensure we
    support arbitrary layouts and an input buffer split across iov entries.

    Fixes: 0d02dbd68c47b ("vhost/scsi: Respond to control queue operations")
    Signed-off-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/vhost/scsi.c | 20 ++++++++++++--------
    1 file changed, 12 insertions(+), 8 deletions(-)

    diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
    index 73a4adeab096..11bd8b6422eb 100644
    --- a/drivers/vhost/scsi.c
    +++ b/drivers/vhost/scsi.c
    @@ -1132,16 +1132,18 @@ vhost_scsi_send_tmf_reject(struct vhost_scsi *vs,
    struct vhost_virtqueue *vq,
    struct vhost_scsi_ctx *vc)
    {
    - struct virtio_scsi_ctrl_tmf_resp __user *resp;
    struct virtio_scsi_ctrl_tmf_resp rsp;
    + struct iov_iter iov_iter;
    int ret;

    pr_debug("%s\n", __func__);
    memset(&rsp, 0, sizeof(rsp));
    rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;
    - resp = vq->iov[vc->out].iov_base;
    - ret = __copy_to_user(resp, &rsp, sizeof(rsp));
    - if (!ret)
    +
    + iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
    +
    + ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
    + if (likely(ret == sizeof(rsp)))
    vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
    else
    pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n");
    @@ -1152,16 +1154,18 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs,
    struct vhost_virtqueue *vq,
    struct vhost_scsi_ctx *vc)
    {
    - struct virtio_scsi_ctrl_an_resp __user *resp;
    struct virtio_scsi_ctrl_an_resp rsp;
    + struct iov_iter iov_iter;
    int ret;

    pr_debug("%s\n", __func__);
    memset(&rsp, 0, sizeof(rsp)); /* event_actual = 0 */
    rsp.response = VIRTIO_SCSI_S_OK;
    - resp = vq->iov[vc->out].iov_base;
    - ret = __copy_to_user(resp, &rsp, sizeof(rsp));
    - if (!ret)
    +
    + iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));
    +
    + ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);
    + if (likely(ret == sizeof(rsp)))
    vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
    else
    pr_err("Faulted on virtio_scsi_ctrl_an_resp\n");
    --
    2.19.1
    \
     
     \ /
      Last update: 2019-02-13 04:01    [W:4.377 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site