linux-stable.git/drivers/vhost, branch v3.16.67

vhost: make sure used idx is seen before log in vhost_add_used_n()

2019-02-11T17:54:25+00:00

commit 841df922417eb82c835e93d4b93eb6a68c99d599 upstream.

We miss a write barrier that guarantees used idx is updated and seen
before log. This will let userspace sync and copy used ring before
used idx is update. Fix this by adding a barrier before log_write().

Fixes: 8dd014adfea6f ("vhost-net: mergeable buffers support")
Acked-by: Michael S. Tsirkin 
Signed-off-by: Jason Wang 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

vhost_net: validate sock before trying to put its fd

2018-11-20T18:05:25+00:00

commit b8f1f65882f07913157c44673af7ec0b308d03eb upstream.

Sock will be NULL if we pass -1 to vhost_net_set_backend(), but when
we meet errors during ubuf allocation, the code does not check for
NULL before calling sockfd_put(), this will lead NULL
dereferencing. Fixing by checking sock pointer before.

Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support")
Reported-by: Dan Carpenter 
Signed-off-by: Jason Wang 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

vhost_net: stop device during reset owner

2018-06-16T21:22:02+00:00

commit 4cd879515d686849eec5f718aeac62a70b067d82 upstream.

We don't stop device before reset owner, this means we could try to
serve any virtqueue kick before reset dev->worker. This will result a
warn since the work was pending at llist during owner resetting. Fix
this by stopping device during owner reset.

Reported-by: syzbot+eb17c6162478cc50632c@syzkaller.appspotmail.com
Fixes: 3a4d5c94e9593 ("vhost_net: a kernel-level virtio server")
Signed-off-by: Jason Wang 
Signed-off-by: David S. Miller 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

drivers/vhost: Fix mmu_context.h assumption

2018-01-09T00:35:08+00:00

Some architectures (such as Alpha) rely on include/linux/sched.h definitions
in their mmu_context.h files.

So include sched.h before mmu_context.h.

(This doesn't seem to be needed upstream, though a similar problem was
fixed by commit 8efd755ac2fe "mm/mmu_context, sched/core: Fix mmu_context.h
assumption".)

Cc: Ingo Molnar 
Cc: Hugh Dickins 
Signed-off-by: Ben Hutchings

vhost: actually track log eventfd file

2015-08-25T09:13:39+00:00

commit 7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5 upstream.

While reviewing vhost log code, I found out that log_file is never
set. Note: I haven't tested the change (QEMU doesn't use LOG_FD yet).

Signed-off-by: Marc-André Lureau 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Luis Henriques

vhost/scsi: potential memory corruption

2015-03-03T14:26:02+00:00

commit 59c816c1f24df0204e01851431d3bab3eb76719c upstream.

This code in vhost_scsi_make_tpg() is confusing because we limit "tpgt"
to UINT_MAX but the data type of "tpg->tport_tpgt" and that is a u16.

I looked at the context and it turns out that in
vhost_scsi_set_endpoint(), "tpg->tport_tpgt" is used as an offset into
the vs_tpg[] array which has VHOST_SCSI_MAX_TARGET (256) elements so
anything higher than 255 then it is invalid.  I have made that the limit
now.

In vhost_scsi_send_evt() we mask away values higher than 255, but now
that the limit has changed, we don't need the mask.

Signed-off-by: Dan Carpenter 
Signed-off-by: Nicholas Bellinger 
[ luis: backported to 3.16: functions rename:
  - tcm_vhost_send_evt -> vhost_scsi_send_evt
  - tcm_vhost_make_tpg -> vhost_scsi_make_tpg ]
Signed-off-by: Luis Henriques

vhost-scsi: Add missing virtio-scsi -> TCM attribute conversion

2015-01-22T16:32:16+00:00

commit 46243860806bdc2756f3ce8ac86b4d7c616bcd6c upstream.

While looking at hch's recent conversion to drop the MSG_*_TAG
definitions, I noticed a long standing bug in vhost-scsi where
the VIRTIO_SCSI_S_* attribute definitions where incorrectly
being passed directly into target_submit_cmd_map_sgls().

This patch adds the missing virtio-scsi to TCM/SAM task attribute
conversion.

Cc: Christoph Hellwig 
Cc: Michael S. Tsirkin 
Cc: Paolo Bonzini 
Signed-off-by: Nicholas Bellinger 
[ luis: backported to 3.16:
  - replaced TCM_*_TAG by MSG_*_TAG ]
Signed-off-by: Luis Henriques

vhost-scsi: Take configfs group dependency during VHOST_SCSI_SET_ENDPOINT

2014-12-01T10:02:11+00:00

commit ab8edab132829b26dd13db6caca3c242cce35dc1 upstream.

This patch addresses a bug where individual vhost-scsi configfs endpoint
groups can be removed from below while active exports to QEMU userspace
still exist, resulting in an OOPs.

It adds a configfs_depend_item() in vhost_scsi_set_endpoint() to obtain
an explicit dependency on se_tpg->tpg_group in order to prevent individual
vhost-scsi WWPN endpoints from being released via normal configfs methods
while an QEMU ioctl reference still exists.

Also, add matching configfs_undepend_item() in vhost_scsi_clear_endpoint()
to release the dependency, once QEMU's reference to the individual group
at /sys/kernel/config/target/vhost/$WWPN/$TPGT is released.

(Fix up vhost_scsi_clear_endpoint() error path - DanC)

Cc: Michael S. Tsirkin 
Cc: Paolo Bonzini 
Cc: Stefan Hajnoczi 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Luis Henriques

vhost-scsi: don't open-code kvfree

2014-06-23T06:22:48+00:00

Now that we have kvfree, use it in vhost-scsi instead of
the open-coded version.

Cc: Nicholas Bellinger 
Signed-off-by: Michael S. Tsirkin

vhost-net: don't open-code kvfree

2014-06-23T06:22:48+00:00

Commit 23cc5a991c ("vhost-net: extend device allocation to vmalloc")
added another open-coded version of kvfree (which is available since
v3.15-rc5), nuke it.

Signed-off-by: Romain Francoise 
Signed-off-by: Michael S. Tsirkin