search for: iov_base

...05:35:56 machine-hostname kernel: [<ffffffff811e3e4e>] SyS_newfstatat+0xe/0x10 Dec 25 05:35:56 machine-hostname kernel: [<ffffffff81645909>] system_call_fastpath+0x16/0x1b (5) enable "cifsFYI", observed cifs.ko keeps printing the logs below: [ 3058.820504] fs/cifs/file.c: 7: iov_base=ffff8800129e6000 iov_len=4096 [ 3058.820506] fs/cifs/file.c: 8: iov_base=ffff88003d4e3000 iov_len=4096 [ 3058.820508] fs/cifs/file.c: 9: iov_base=ffff8800109cb000 iov_len=4096 [ 3058.820510] fs/cifs/file.c: 10: iov_base=ffff88003b56b000 iov_len=4096 [ 3058.820512] fs/cifs/file.c: 11: iov_base=ffff8...

...rw, struct kiocb *io unsigned long nr_segs) { int seg; + int i; size_t size; unsigned long addr; unsigned blocksize_mask = root->sectorsize - 1; @@ -6219,8 +6220,22 @@ static ssize_t check_direct_IO(struct btrfs_root *root, int rw, struct kiocb *io addr = (unsigned long)iov[seg].iov_base; size = iov[seg].iov_len; end += size; - if ((addr & blocksize_mask) || (size & blocksize_mask)) + if ((addr & blocksize_mask) || (size & blocksize_mask)) goto out; + + /* If this is a write we don''t need to check anymore */ + if (rw & WRITE) + continue...

...struct socket *sock = rcu_dereference(vq->private_data); if (!sock) return; @@ -124,7 +123,6 @@ if (wmem < sock->sk->sk_sndbuf * 2) tx_poll_stop(net); - hdr_size = vq->hdr_size; for (;;) { head.iov_base = (void *)vhost_get_vq_desc(&net->dev, vq, @@ -148,25 +146,45 @@ "out %d, int %d\n", out, in); break; } + if (vq->guest_hlen > vq->sock_hlen) { + if (msg.msg_iov[0].i...

...struct socket *sock = rcu_dereference(vq->private_data); if (!sock) return; @@ -124,7 +123,6 @@ if (wmem < sock->sk->sk_sndbuf * 2) tx_poll_stop(net); - hdr_size = vq->hdr_size; for (;;) { head.iov_base = (void *)vhost_get_vq_desc(&net->dev, vq, @@ -148,25 +146,45 @@ "out %d, int %d\n", out, in); break; } + if (vq->guest_hlen > vq->sock_hlen) { + if (msg.msg_iov[0].i...

...n) { - virtio_transport_free_pkt(pkt); - vq_err(vq, "Faulted on copying pkt buf\n"); - break; + remain_len = pkt->len; + for (i = 0; i < pkt->nr_vecs; i++) { + int tmp_len; + + tmp_len = min(remain_len, pkt->vec[i].iov_len); + nbytes = copy_to_iter(pkt->vec[i].iov_base, tmp_len, &iov_iter); + if (nbytes != tmp_len) { + virtio_transport_free_pkt(pkt); + vq_err(vq, "Faulted on copying pkt buf\n"); + break; + } + + remain_len -= tmp_len; } vhost_add_used_n(vq, vq->heads, headcount); @@ -341,6 +351,7 @@ static void vhost_transpo...

...n) { - virtio_transport_free_pkt(pkt); - vq_err(vq, "Faulted on copying pkt buf\n"); - break; + remain_len = pkt->len; + for (i = 0; i < pkt->nr_vecs; i++) { + int tmp_len; + + tmp_len = min(remain_len, pkt->vec[i].iov_len); + nbytes = copy_to_iter(pkt->vec[i].iov_base, tmp_len, &iov_iter); + if (nbytes != tmp_len) { + virtio_transport_free_pkt(pkt); + vq_err(vq, "Faulted on copying pkt buf\n"); + break; + } + + remain_len -= tmp_len; } vhost_add_used_n(vq, vq->heads, headcount); @@ -341,6 +351,7 @@ static void vhost_transpo...

...aulted on copying pkt buf\n"); >> - break; >> + remain_len = pkt->len; >> + for (i = 0; i < pkt->nr_vecs; i++) { >> + int tmp_len; >> + >> + tmp_len = min(remain_len, pkt->vec[i].iov_len); >> + nbytes = copy_to_iter(pkt->vec[i].iov_base, tmp_len, &iov_iter); >> + if (nbytes != tmp_len) { >> + virtio_transport_free_pkt(pkt); >> + vq_err(vq, "Faulted on copying pkt buf\n"); >> + break; >> + } >> + >> + remain_len -= tmp_len; >> } >> >> vho...

...aulted on copying pkt buf\n"); >> - break; >> + remain_len = pkt->len; >> + for (i = 0; i < pkt->nr_vecs; i++) { >> + int tmp_len; >> + >> + tmp_len = min(remain_len, pkt->vec[i].iov_len); >> + nbytes = copy_to_iter(pkt->vec[i].iov_base, tmp_len, &iov_iter); >> + if (nbytes != tmp_len) { >> + virtio_transport_free_pkt(pkt); >> + vq_err(vq, "Faulted on copying pkt buf\n"); >> + break; >> + } >> + >> + remain_len -= tmp_len; >> } >> >> vho...

...-/* Pop first len bytes from iovec. Return number of segments used. */ -static int move_iovec_hdr(struct iovec *from, struct iovec *to, - size_t len, int iov_count) -{ - int seg = 0; - size_t size; - - while (len && seg < iov_count) { - size = min(from->iov_len, len); - to->iov_base = from->iov_base; - to->iov_len = size; - from->iov_len -= size; - from->iov_base += size; - len -= size; - ++from; - ++to; - ++seg; - } - return seg; -} -/* Copy iovec entries for len bytes from iovec. */ -static void copy_iovec_hdr(const struct iovec *from, struct iovec *to, -...

...-/* Pop first len bytes from iovec. Return number of segments used. */ -static int move_iovec_hdr(struct iovec *from, struct iovec *to, - size_t len, int iov_count) -{ - int seg = 0; - size_t size; - - while (len && seg < iov_count) { - size = min(from->iov_len, len); - to->iov_base = from->iov_base; - to->iov_len = size; - from->iov_len -= size; - from->iov_base += size; - len -= size; - ++from; - ++to; - ++seg; - } - return seg; -} -/* Copy iovec entries for len bytes from iovec. */ -static void copy_iovec_hdr(const struct iovec *from, struct iovec *to, -...

...> - vq_err(vq, "Faulted on copying pkt buf\n"); > - break; > + remain_len = pkt->len; > + for (i = 0; i < pkt->nr_vecs; i++) { > + int tmp_len; > + > + tmp_len = min(remain_len, pkt->vec[i].iov_len); > + nbytes = copy_to_iter(pkt->vec[i].iov_base, tmp_len, &iov_iter); > + if (nbytes != tmp_len) { > + virtio_transport_free_pkt(pkt); > + vq_err(vq, "Faulted on copying pkt buf\n"); > + break; > + } > + > + remain_len -= tmp_len; > } > > vhost_add_used_n(vq, vq->heads, headcou...

On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > + memset(&rsp, 0, sizeof(rsp)); > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > + resp = vq->iov[out].iov_base; > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > Is it actually safe to trust that iov_base has passed an earlier > access_ok() check here? Why not just use copy_to_user() instead? Good point. We really should have removed those double-underscore things ages ago. Als...

On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > + memset(&rsp, 0, sizeof(rsp)); > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > + resp = vq->iov[out].iov_base; > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > Is it actually safe to trust that iov_base has passed an earlier > access_ok() check here? Why not just use copy_to_user() instead? Good point. We really should have removed those double-underscore things ages ago. Als...

Currently virtio-net code relys on the layout of descriptor, this patchset removed the assumptions and introduced a control command to set mac address. Last patch is a trivial renaming. V2: check guest's iov_len V3: fix of migration compatibility make mac field in config space read-only when new feature is acked V4: add fix of descriptor layout assumptions, trivial rename V5: fix

Currently virtio-net code relys on the layout of descriptor, this patchset removed the assumptions and introduced a control command to set mac address. Last patch is a trivial renaming. V2: check guest's iov_len V3: fix of migration compatibility make mac field in config space read-only when new feature is acked V4: add fix of descriptor layout assumptions, trivial rename V5: fix

...> >> - break; > >> + remain_len = pkt->len; > >> + for (i = 0; i < pkt->nr_vecs; i++) { > >> + int tmp_len; > >> + > >> + tmp_len = min(remain_len, pkt->vec[i].iov_len); > >> + nbytes = copy_to_iter(pkt->vec[i].iov_base, tmp_len, &iov_iter); > >> + if (nbytes != tmp_len) { > >> + virtio_transport_free_pkt(pkt); > >> + vq_err(vq, "Faulted on copying pkt buf\n"); > >> + break; > >> + } > >> + > >> + remain_len -= tmp_len; &gt...

...irtio_pstore_hdr *hdr; > > + ssize_t len; > > + > > + for (;;) { > > + elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); > > + if (!elem) { > > + return; > > + } > > + > > + hdr = elem->out_sg[0].iov_base; > > + if (elem->out_sg[0].iov_len != sizeof(*hdr)) { > > + error_report("invalid header size: %u", > > + (unsigned)elem->out_sg[0].iov_len); > > + exit(1); > > + } > > Please use iov_to...

...irtio_pstore_hdr *hdr; > > + ssize_t len; > > + > > + for (;;) { > > + elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); > > + if (!elem) { > > + return; > > + } > > + > > + hdr = elem->out_sg[0].iov_base; > > + if (elem->out_sg[0].iov_len != sizeof(*hdr)) { > > + error_report("invalid header size: %u", > > + (unsigned)elem->out_sg[0].iov_len); > > + exit(1); > > + } > > Please use iov_to...

...+ +struct vhost_blk { + struct task_struct *host_kick; + struct vhost_blk_req *reqs; + struct vhost_virtqueue vq; + struct llist_head llhead; + struct vhost_dev dev; + u16 reqs_nr; + int index; +}; + +static inline int iov_num_pages(struct iovec *iov) +{ + return (PAGE_ALIGN((unsigned long)iov->iov_base + iov->iov_len) - + ((unsigned long)iov->iov_base & PAGE_MASK)) >> PAGE_SHIFT; +} + +static int vhost_blk_setup(struct vhost_blk *blk) +{ + blk->reqs_nr = blk->vq.num; + + blk->reqs = kmalloc(sizeof(struct vhost_blk_req) * blk->reqs_nr, + GFP_KERNEL); + if (...

...+ +struct vhost_blk { + struct task_struct *host_kick; + struct vhost_blk_req *reqs; + struct vhost_virtqueue vq; + struct llist_head llhead; + struct vhost_dev dev; + u16 reqs_nr; + int index; +}; + +static inline int iov_num_pages(struct iovec *iov) +{ + return (PAGE_ALIGN((unsigned long)iov->iov_base + iov->iov_len) - + ((unsigned long)iov->iov_base & PAGE_MASK)) >> PAGE_SHIFT; +} + +static int vhost_blk_setup(struct vhost_blk *blk) +{ + blk->reqs_nr = blk->vq.num; + + blk->reqs = kmalloc(sizeof(struct vhost_blk_req) * blk->reqs_nr, + GFP_KERNEL); + if (...