search for: 65a84dde0214b0387ccd

On Sat, Apr 7, 2018 at 3:02 AM, syzbot <syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com> wrote: > syzbot hit the following crash on upstream commit > 38c23685b273cfb4ccf31a199feccce3bdcb5d83 (Fri Apr 6 04:29:35 2018 +0000) > Merge tag 'armsoc-drivers' of > git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc > syzbot dashboar...

On Sat, Apr 7, 2018 at 3:02 AM, syzbot <syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com> wrote: > syzbot hit the following crash on upstream commit > 38c23685b273cfb4ccf31a199feccce3bdcb5d83 (Fri Apr 6 04:29:35 2018 +0000) > Merge tag 'armsoc-drivers' of > git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc > syzbot dashboar...

On Mon, Apr 09, 2018 at 05:44:36AM +0300, Michael S. Tsirkin wrote: > On Mon, Apr 09, 2018 at 10:37:45AM +0800, Stefan Hajnoczi wrote: > > On Sat, Apr 7, 2018 at 3:02 AM, syzbot > > <syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com> wrote: > > > syzbot hit the following crash on upstream commit > > > 38c23685b273cfb4ccf31a199feccce3bdcb5d83 (Fri Apr 6 04:29:35 2018 +0000) > > > Merge tag 'armsoc-drivers' of > > > git://git.kernel.org/pub/scm/linux/ker...

...e logic was originally: if (vq->iotlb) return 1; return A && B; After the patch the short-circuit logic for A was inverted: if (A || vq->iotlb) return A; return B; The correct logic is: if (!A || vq->iotlb) return A; return B; Reported-by: syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com Cc: Jason Wang <jasowang at redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com> --- drivers/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 5320039671b7..f...

...e logic was originally: if (vq->iotlb) return 1; return A && B; After the patch the short-circuit logic for A was inverted: if (A || vq->iotlb) return A; return B; The correct logic is: if (!A || vq->iotlb) return A; return B; Reported-by: syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com Cc: Jason Wang <jasowang at redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com> --- drivers/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 5320039671b7..f...

On Mon, Apr 09, 2018 at 10:37:45AM +0800, Stefan Hajnoczi wrote: > On Sat, Apr 7, 2018 at 3:02 AM, syzbot > <syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com> wrote: > > syzbot hit the following crash on upstream commit > > 38c23685b273cfb4ccf31a199feccce3bdcb5d83 (Fri Apr 6 04:29:35 2018 +0000) > > Merge tag 'armsoc-drivers' of > > git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc...

...was inverted: > > if (A || vq->iotlb) > return A; > return B; > > This patch fixes the regression by rewriting the checks in the obvious > way, no longer returning A when vq->iotlb is non-NULL (which is hard to > understand). > > Reported-by: syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com > Cc: Jason Wang <jasowang at redhat.com> > Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com> This patch only makes sense after patch 2/2 is applied. Otherwise the logic seems reversed below. Can you pls squash these two? > --- > driver...

...e logic was originally: if (vq->iotlb) return 1; return A && B; After the patch the short-circuit logic for A was inverted: if (A || vq->iotlb) return A; return B; The correct logic is: if (!A || vq->iotlb) return A; return B; Reported-by: syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com Cc: Jason Wang <jasowang at redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com> Acked-by: Michael S. Tsirkin <mst at redhat.com> --- drivers/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vho...

...B; After the patch the short-circuit logic for A was inverted: if (A || vq->iotlb) return A; return B; This patch fixes the regression by rewriting the checks in the obvious way, no longer returning A when vq->iotlb is non-NULL (which is hard to understand). Reported-by: syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com Cc: Jason Wang <jasowang at redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com> --- drivers/vhost/vhost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 5320039...

...B; After the patch the short-circuit logic for A was inverted: if (A || vq->iotlb) return A; return B; This patch fixes the regression by rewriting the checks in the obvious way, no longer returning A when vq->iotlb is non-NULL (which is hard to understand). Reported-by: syzbot+65a84dde0214b0387ccd at syzkaller.appspotmail.com Cc: Jason Wang <jasowang at redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com> --- drivers/vhost/vhost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index bec722e...

v2: * Rewrote the conditional to make the vq access check clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi (2): vhost: fix vhost_vq_access_ok() log check vhost:

v2: * Rewrote the conditional to make the vq access check clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi (2): vhost: fix vhost_vq_access_ok() log check vhost:

v3: * Rebased onto net/master and resolved conflict [DaveM] v2: * Rewrote the conditional to make the vq access check clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi

v3: * Rebased onto net/master and resolved conflict [DaveM] v2: * Rewrote the conditional to make the vq access check clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi