search for: pizhenwei

On Wed, 10 May 2023 10:54:37 +0800, zhenwei pi <pizhenwei at bytedance.com> wrote: > Both split ring and packed ring use 32bits to describe the length of > a descriptor: see struct vring_desc and struct vring_packed_desc. > This means the max segment size supported by virtio is U32_MAX. > > An example of virtio_max_dma_size in virtio_blk...

On Wed, May 10, 2023 at 11:26:54AM +0800, Xuan Zhuo wrote: > On Wed, 10 May 2023 10:54:37 +0800, zhenwei pi <pizhenwei at bytedance.com> wrote: > > Both split ring and packed ring use 32bits to describe the length of > > a descriptor: see struct vring_desc and struct vring_packed_desc. > > This means the max segment size supported by virtio is U32_MAX. > > > > An example of virtio_m...

On Wed, May 10, 2023 at 11:44?AM Michael S. Tsirkin <mst at redhat.com> wrote: > > On Wed, May 10, 2023 at 11:26:54AM +0800, Xuan Zhuo wrote: > > On Wed, 10 May 2023 10:54:37 +0800, zhenwei pi <pizhenwei at bytedance.com> wrote: > > > Both split ring and packed ring use 32bits to describe the length of > > > a descriptor: see struct vring_desc and struct vring_packed_desc. > > > This means the max segment size supported by virtio is U32_MAX. > > > > > &g...

...e_max, &v); max_size = min(max_size, v); There is a risk during implicit convert here, once virtio_max_dma_size returns 4G, max_size becomes 0. Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") Cc: Joerg Roedel <jroedel at suse.de> Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> --- drivers/virtio/virtio_ring.c | 12 ++++++++---- include/linux/virtio.h | 2 +- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c index c5310eaf8b46..55cfecf030a1 100644 --- a/drivers/virtio/vir...

...x_size, v); > > There is a risk during implicit convert here, once virtio_max_dma_size > returns 4G, max_size becomes 0. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Cc: Joerg Roedel <jroedel at suse.de> > Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> is this a theoretical concern or do you manage to trigger this somehow? > --- > drivers/virtio/virtio_ring.c | 12 ++++++++---- > include/linux/virtio.h | 2 +- > 2 files changed, 9 insertions(+), 5 deletions(-) > > diff --git a/drivers/virtio/virt...

...x_size, v); > > There is a risk during implicit convert here, once virtio_max_dma_size > returns 4G, max_size becomes 0. > > Fixes: e6d6dd6c875e ("virtio: Introduce virtio_max_dma_size()") > Cc: Joerg Roedel <jroedel at suse.de> > Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> > --- > drivers/virtio/virtio_ring.c | 12 ++++++++---- > include/linux/virtio.h | 2 +- > 2 files changed, 9 insertions(+), 5 deletions(-) > > diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c > index c5310eaf8b46..55cfecf03...

...rtio-ports vport0p1: Error allocating inbufs The reason is that the port is unplugged and the vq buf still remained. So, fix two cases in this patch: 1, fix memory leak with attach-device/detach-device. 2, fix logic bug with attach-device/detach-device/attach-device. Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> --- drivers/char/virtio_console.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index fbeb719..f6e37f4 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virti...

...rtio-ports vport0p1: Error allocating inbufs The reason is that the port is unplugged and the vq buf still remained. So, fix two cases in this patch: 1, fix memory leak with attach-device/detach-device. 2, fix logic bug with attach-device/detach-device/attach-device. Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> --- drivers/char/virtio_console.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index fbeb719..f6e37f4 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virti...

...rtio-ports vport0p1: Error allocating inbufs The reason is that the port is unplugged and the vq buf still remained. So, fix two cases in this patch: 1, fix memory leak with attach-device/detach-device. 2, fix logic bug with attach-device/detach-device/attach-device. Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> --- drivers/char/virtio_console.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index fbeb719..f6e37f4 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virti...

...ng inbufs > > The reason is that the port is unplugged and the vq buf still remained. > So, fix two cases in this patch: > 1, fix memory leak with attach-device/detach-device. > 2, fix logic bug with attach-device/detach-device/attach-device. > > Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> > --- > drivers/char/virtio_console.c | 21 +++++++++++++++------ > 1 file changed, 15 insertions(+), 6 deletions(-) > > diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c > index fbeb719..f6e37f4 100644 > --- a/drivers/char/virtio...

The following codes have an implicit conversion from size_t to u32: (u32)max_size = (size_t)virtio_max_dma_size(vdev); This may lead overflow, Ex (size_t)4G -> (u32)0. Once virtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX instead. Signed-off-by: zhenwei pi <pizhenwei at bytedance.com> --- drivers/block/virtio_blk.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c index 1fe011676d07..4a4b9bad551e 100644 --- a/drivers/block/virtio_blk.c +++ b/drivers/block/virtio_blk.c @@ -1313,6 +1...