search for: nrbufs

Quit from splice_write if pipe->nrbufs is 0 for avoiding oops in virtio-serial. When an application was doing splice from a kernel buffer to virtio-serial on a guest, the application received signal(SIGINT). This situation will normally happen, but the kernel executed a kernel panic by oops as follows: BUG: unable to handle kernel pa...

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each patch. Changes i...

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each patch. Changes i...

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each patch. Changes i...

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each patch. Changes i...

From: Sjur Br?ndeland <sjur.brandeland at stericsson.com> I thought rebasing rproc_serial to linux-next was going to be trivial. But when starting the merge I realized that I had to refactor the the patches from Masami Hiramatsu. The splice support has the same issue as I faced, with different type of buffers in the out_vq. So I ended up refactoring the splice functionality. The code size

From: Sjur Br?ndeland <sjur.brandeland at stericsson.com> I thought rebasing rproc_serial to linux-next was going to be trivial. But when starting the merge I realized that I had to refactor the the patches from Masami Hiramatsu. The splice support has the same issue as I faced, with different type of buffers in the out_vq. So I ended up refactoring the splice functionality. The code size

...uf = alloc_buf(port->portdev->vdev, count, 0); > if (!buf) > return -ENOMEM; > > @@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, > if (ret < 0) > goto error_out; > > - buf = alloc_buf(port->out_vq, 0, pipe->nrbufs); > + buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs); > if (!buf) { > ret = -ENOMEM; > goto error_out; > @@ -1374,7 +1374,7 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock) > > nr_added_bufs = 0; > do { > - buf = all...

...uf = alloc_buf(port->portdev->vdev, count, 0); > if (!buf) > return -ENOMEM; > > @@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, > if (ret < 0) > goto error_out; > > - buf = alloc_buf(port->out_vq, 0, pipe->nrbufs); > + buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs); > if (!buf) { > ret = -ENOMEM; > goto error_out; > @@ -1374,7 +1374,7 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock) > > nr_added_bufs = 0; > do { > - buf = all...

...), 5 deletions(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 8722656..8a15af3 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -936,16 +936,21 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, * pipe->nrbufs == 0 means there are no data to transfer, * so this returns just 0 for no data. */ - if (!pipe->nrbufs) - return 0; + pipe_lock(pipe); + if (!pipe->nrbufs) { + ret = 0; + goto error_out; + } ret = wait_port_writable(port, filp->f_flags & O_NONBLOCK); if (ret < 0) - r...

...lloc_buf(port->out_vq, count, 0); + buf = alloc_buf(port->portdev->vdev, count, 0); if (!buf) return -ENOMEM; @@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, if (ret < 0) goto error_out; - buf = alloc_buf(port->out_vq, 0, pipe->nrbufs); + buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs); if (!buf) { ret = -ENOMEM; goto error_out; @@ -1374,7 +1374,7 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock) nr_added_bufs = 0; do { - buf = alloc_buf(vq, PAGE_SIZE, 0); + buf = alloc_buf(...

..., count, 0); > > if (!buf) > > return -ENOMEM; > > > > @@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, > > if (ret < 0) > > goto error_out; > > > > - buf = alloc_buf(port->out_vq, 0, pipe->nrbufs); > > + buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs); > > if (!buf) { > > ret = -ENOMEM; > > goto error_out; > > @@ -1374,7 +1374,7 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock) > > > > nr_added_bufs...

Signed-off-by: Tiger Yang <tiger.yang at oracle.com> --- Config.make.in | 1 + configure.in | 6 ++++++ fs/ocfs2/Makefile | 4 ++++ kapi-compat/include/pipe_buf_operations.h | 10 ++++++++++ 4 files changed, 21 insertions(+), 0 deletions(-) create mode 100644 kapi-compat/include/pipe_buf_operations.h

Turns out virtio console tries to take a buffer out of an active vq. Works by sheer luck, and is explicitly forbidden by spec. And while going over it I saw that error handling is also broken - failure is easy to trigger if I force allocations to fail. Lightly tested. Michael S. Tsirkin (6): virtio_console: don't tie bufs to a vq virtio: add ability to iterate over vqs virtio_console:

Turns out virtio console tries to take a buffer out of an active vq. Works by sheer luck, and is explicitly forbidden by spec. And while going over it I saw that error handling is also broken - failure is easy to trigger if I force allocations to fail. Lightly tested. Michael S. Tsirkin (6): virtio_console: don't tie bufs to a vq virtio: add ability to iterate over vqs virtio_console:

...implement poll() correctly with the new head + tail > approach? Just take the mutex? Firstly, the BUG_ON() check probably isn't necessary here - the same issue with occupancy being seen to be greater than the queue depth existed previously (there was no locking around the read of pipe->nrbufs and pipe->buffers). I added a sanity check. Secondly, it should be possible to make it such that just the spinlock suffices. The following few patches make the main pipe read/write routines use the spinlock so as not to be interfered with by notification insertion. I didn't roll the spin...

On (Fri) 19 Jul 2013 [18:19:51], Yoshihiro YUNOMAE wrote: > Hi, > > This patch set fixes two bugs of splice_write in the virtio-console driver. > > [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. > => This induces oops in sg_init_table(). > > [BUG2] No lock for competition of splice_write. > => This induces oops in splice_from_pipe_feed() by bug of any user > application. > > These reports ar...

On (Mon) 22 Jul 2013 [13:00:43], Yoshihiro YUNOMAE wrote: > Hi, > > This patch set fixes two bugs of splice_write in the virtio-console driver. > > [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. > => This induces oops in sg_init_table(). > > [BUG2] No lock for competition of splice_write. > => This induces oops in splice_from_pipe_feed() by bug of any user > application. > > These reports ar...

This patch-set introduces a new virtio type "rproc_serial" for communicating with remote processors over shared memory. The driver depends on the the remoteproc framework. As preparation for introducing "rproc_serial" I've done a refactoring of the transmit buffer handling. NOTE: These two patches are identical to first two patches of the V8 patch-set, but are rebased to

This patch-set introduces a new virtio type "rproc_serial" for communicating with remote processors over shared memory. The driver depends on the the remoteproc framework. As preparation for introducing "rproc_serial" I've done a refactoring of the transmit buffer handling. NOTE: These two patches are identical to first two patches of the V8 patch-set, but are rebased to