search for: copy_from_iter

...st_chr_write_iter(struct vhost_dev *dev, struct iov_iter *from) { - struct vhost_msg_node node; - unsigned size = sizeof(struct vhost_msg); - size_t ret; - int err; + struct vhost_iotlb_msg msg; + size_t offset; + int type, ret; - if (iov_iter_count(from) < size) - return 0; - ret = copy_from_iter(&node.msg, size, from); - if (ret != size) + ret = copy_from_iter(&type, sizeof(type), from); + if (ret != sizeof(type)) goto done; - switch (node.msg.type) { + switch (type) { case VHOST_IOTLB_MSG: - err = vhost_process_iotlb_msg(dev, &node.msg.iotlb); - if (err) - ret = err...

...st_chr_write_iter(struct vhost_dev *dev, struct iov_iter *from) { - struct vhost_msg_node node; - unsigned size = sizeof(struct vhost_msg); - size_t ret; - int err; + struct vhost_iotlb_msg msg; + size_t offset; + int type, ret; - if (iov_iter_count(from) < size) - return 0; - ret = copy_from_iter(&node.msg, size, from); - if (ret != size) + ret = copy_from_iter(&type, sizeof(type), from); + if (ret != sizeof(type)) goto done; - switch (node.msg.type) { + switch (type) { case VHOST_IOTLB_MSG: - err = vhost_process_iotlb_msg(dev, &node.msg.iotlb); - if (err) - ret = err...

...es mm with the vhost kernel thread because it could see a zero page unexpectedly and theoretically make an incorrect decision visible outside of the killed task context. Make sure that each place which can read from userspace is annotated properly and it uses copy_from_user_mm, __get_user_mm resp. copy_from_iter_mm. Each will get the target mm as an argument and it performs a pessimistic check to rule out that the oom_reaper could possibly unmap the particular page. __oom_reap_task then just needs to mark the mm as unstable before it unmaps any page. This is a preparatory patch without any functional chan...

...es mm with the vhost kernel thread because it could see a zero page unexpectedly and theoretically make an incorrect decision visible outside of the killed task context. Make sure that each place which can read from userspace is annotated properly and it uses copy_from_user_mm, __get_user_mm resp. copy_from_iter_mm. Each will get the target mm as an argument and it performs a pessimistic check to rule out that the oom_reaper could possibly unmap the particular page. __oom_reap_task then just needs to mark the mm as unstable before it unmaps any page. This is a preparatory patch without any functional chan...

...read because it could see a zero > page unexpectedly and theoretically make an incorrect decision visible > outside of the killed task context. > > Make sure that each place which can read from userspace is annotated > properly and it uses copy_from_user_mm, __get_user_mm resp. > copy_from_iter_mm. Each will get the target mm as an argument and it > performs a pessimistic check to rule out that the oom_reaper could > possibly unmap the particular page. __oom_reap_task then just needs to > mark the mm as unstable before it unmaps any page. > > This is a preparatory patch wi...

...; > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c > index 3a5f81a66d34..03014224ef13 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -1024,8 +1024,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev, > int type, ret; > > ret = copy_from_iter(&type, sizeof(type), from); > - if (ret != sizeof(type)) > + if (ret != sizeof(type)) { > + ret = -EINVAL; > goto done; > + } > > switch (type) { > case VHOST_IOTLB_MSG: should this be EFAULT rather? > @@ -1044,8 +1046,10 @@ ssize_t vhost_chr_write_iter(st...

...nybody know which accesses are being ordered here? Usually you'd need >> a READ_ONCE()/rcu_dereference() beginning the chain, but I haven't managed >> to find one... I think what it's trying to separate is using indirect->addr as a base and then reading from that through copy_from_iter. Cheers, -- Email: Herbert Xu <herbert at gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

..._iter *from) > { > - struct vhost_msg_node node; > - unsigned size = sizeof(struct vhost_msg); > - size_t ret; > - int err; > + struct vhost_iotlb_msg msg; > + size_t offset; > + int type, ret; > > - if (iov_iter_count(from) < size) > - return 0; > - ret = copy_from_iter(&node.msg, size, from); > - if (ret != size) > + ret = copy_from_iter(&type, sizeof(type), from); > + if (ret != sizeof(type)) > goto done; > > - switch (node.msg.type) { > + switch (type) { > case VHOST_IOTLB_MSG: > - err = vhost_process_iotlb_msg(dev, &a...

...); > - if (ret < 0) { > - vq_err(vq, "IOTLB translation failure: uaddr " > - "%p size 0x%llx\n", from, > - (unsigned long long) size); > - goto out; > - } > - iov_iter_init(&f, READ, vq->iotlb_iov, ret, size); > - ret = copy_from_iter(to, size, &f); > - if (ret == size) > - ret = 0; > - } > + if (uaddr) > + return __copy_from_user(to, uaddr, size); > + > + ret = translate_desc(vq, (u64)(uintptr_t)from, size, vq->iotlb_iov, > + ARRAY_SIZE(vq->iotlb_iov), > + VHOST_ACCESS_RO);...

...st_chr_write_iter(struct vhost_dev *dev, struct iov_iter *from) { - struct vhost_msg_node node; - unsigned size = sizeof(struct vhost_msg); - size_t ret; - int err; + struct vhost_iotlb_msg msg; + size_t offset; + int type, ret; - if (iov_iter_count(from) < size) - return 0; - ret = copy_from_iter(&node.msg, size, from); - if (ret != size) + ret = copy_from_iter(&type, sizeof(type), from); + if (ret != sizeof(type)) goto done; - switch (node.msg.type) { + switch (type) { case VHOST_IOTLB_MSG: - err = vhost_process_iotlb_msg(dev, &node.msg.iotlb); - if (err) - ret = err...

Hi all, In an attempt to remove the remaining traces of [smp_]read_barrier_depends() following my previous patches to strengthen READ_ONCE() for Alpha [1], I ended up trying to decipher the read_barrier_depends() usage in the vhost driver: --->8 // drivers/vhost/vhost.c static int get_indirect(struct vhost_virtqueue *vq, struct iovec iov[], unsigned int iov_size, unsigned int *out_num,

Hi all, In an attempt to remove the remaining traces of [smp_]read_barrier_depends() following my previous patches to strengthen READ_ONCE() for Alpha [1], I ended up trying to decipher the read_barrier_depends() usage in the vhost driver: --->8 // drivers/vhost/vhost.c static int get_indirect(struct vhost_virtqueue *vq, struct iovec iov[], unsigned int iov_size, unsigned int *out_num,

...* architectures only need a compiler barrier here. */ @@ -1164,8 +1166,8 @@ static int get_indirect(struct vhost_virtqueue *vq, i, count); return -EINVAL; } - if (unlikely(memcpy_fromiovec((unsigned char *)&desc, - vq->indirect, sizeof desc))) { + if (unlikely(copy_from_iter(&desc, sizeof(desc), &from) != + sizeof(desc))) { vq_err(vq, "Failed indirect descriptor: idx %d, %zx\n", i, (size_t)vhost64_to_cpu(vq, indirect->addr) + i * sizeof desc); return -EINVAL; diff --git a/include/linux/uio.h b/include/linux/uio.h index 1c5...

...* architectures only need a compiler barrier here. */ @@ -1164,8 +1166,8 @@ static int get_indirect(struct vhost_virtqueue *vq, i, count); return -EINVAL; } - if (unlikely(memcpy_fromiovec((unsigned char *)&desc, - vq->indirect, sizeof desc))) { + if (unlikely(copy_from_iter(&desc, sizeof(desc), &from) != + sizeof(desc))) { vq_err(vq, "Failed indirect descriptor: idx %d, %zx\n", i, (size_t)vhost64_to_cpu(vq, indirect->addr) + i * sizeof desc); return -EINVAL; diff --git a/include/linux/uio.h b/include/linux/uio.h index 1c5...

...\n", in); @@ -375,13 +386,17 @@ static void vhost_transport_send_pkt_work(struct vhost_work *work) return NULL; } - pkt->buf = kmalloc(pkt->len, GFP_KERNEL); - if (!pkt->buf) { + buf = kmalloc(pkt->len, GFP_KERNEL); + if (!buf) { kfree(pkt); return NULL; } - nbytes = copy_from_iter(pkt->buf, pkt->len, &iov_iter); + pkt->vec[0].iov_base = buf; + pkt->vec[0].iov_len = pkt->len; + pkt->nr_vecs = 1; + + nbytes = copy_from_iter(buf, pkt->len, &iov_iter); if (nbytes != pkt->len) { vq_err(vq, "Expected %u byte payload, got %zu bytes\n",...

...\n", in); @@ -375,13 +386,17 @@ static void vhost_transport_send_pkt_work(struct vhost_work *work) return NULL; } - pkt->buf = kmalloc(pkt->len, GFP_KERNEL); - if (!pkt->buf) { + buf = kmalloc(pkt->len, GFP_KERNEL); + if (!buf) { kfree(pkt); return NULL; } - nbytes = copy_from_iter(pkt->buf, pkt->len, &iov_iter); + pkt->vec[0].iov_base = buf; + pkt->vec[0].iov_len = pkt->len; + pkt->nr_vecs = 1; + + nbytes = copy_from_iter(buf, pkt->len, &iov_iter); if (nbytes != pkt->len) { vq_err(vq, "Expected %u byte payload, got %zu bytes\n",...

...t;> return NULL; >> } >> >> - pkt->buf = kmalloc(pkt->len, GFP_KERNEL); >> - if (!pkt->buf) { >> + buf = kmalloc(pkt->len, GFP_KERNEL); >> + if (!buf) { >> kfree(pkt); >> return NULL; >> } >> >> - nbytes = copy_from_iter(pkt->buf, pkt->len, &iov_iter); >> + pkt->vec[0].iov_base = buf; >> + pkt->vec[0].iov_len = pkt->len; >> + pkt->nr_vecs = 1; >> + >> + nbytes = copy_from_iter(buf, pkt->len, &iov_iter); >> if (nbytes != pkt->len) { >> vq...

...t;> return NULL; >> } >> >> - pkt->buf = kmalloc(pkt->len, GFP_KERNEL); >> - if (!pkt->buf) { >> + buf = kmalloc(pkt->len, GFP_KERNEL); >> + if (!buf) { >> kfree(pkt); >> return NULL; >> } >> >> - nbytes = copy_from_iter(pkt->buf, pkt->len, &iov_iter); >> + pkt->vec[0].iov_base = buf; >> + pkt->vec[0].iov_len = pkt->len; >> + pkt->nr_vecs = 1; >> + >> + nbytes = copy_from_iter(buf, pkt->len, &iov_iter); >> if (nbytes != pkt->len) { >> vq...

...t;>> --- a/drivers/vhost/vsock.c >>> +++ b/drivers/vhost/vsock.c >>> @@ -320,6 +320,8 @@ vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq, >>> return NULL; >>> } >>> + pkt->buf_len = pkt->len; >>> + >>> nbytes = copy_from_iter(pkt->buf, pkt->len, &iov_iter); >>> if (nbytes != pkt->len) { >>> vq_err(vq, "Expected %u byte payload, got %zu bytes\n", >>> diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h >>> index e223e2632edd..345f04ee...

...t;>> --- a/drivers/vhost/vsock.c >>> +++ b/drivers/vhost/vsock.c >>> @@ -320,6 +320,8 @@ vhost_vsock_alloc_pkt(struct vhost_virtqueue *vq, >>> return NULL; >>> } >>> + pkt->buf_len = pkt->len; >>> + >>> nbytes = copy_from_iter(pkt->buf, pkt->len, &iov_iter); >>> if (nbytes != pkt->len) { >>> vq_err(vq, "Expected %u byte payload, got %zu bytes\n", >>> diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h >>> index e223e2632edd..345f04ee...