search for: port_fops_splice_write

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each

Hi, This patch set fixes two bugs of splice_write in the virtio-console driver. [BUG1] Although pipe->nrbufs is empty, the driver tries to do splice_write. => This induces oops in sg_init_table(). [BUG2] No lock for competition of splice_write. => This induces oops in splice_from_pipe_feed() by bug of any user application. These reports are written in each

...e6c0 ffff88007b55fe20 Call Trace: [<ffffffff8139ca59>] ? alloc_buf.isra.13+0x39/0xb0 [<ffffffff8139dd00>] ? virtcons_restore+0x100/0x100 [<ffffffff811a6e8e>] __splice_from_pipe+0x7e/0x90 [<ffffffff8139ca59>] ? alloc_buf.isra.13+0x39/0xb0 [<ffffffff8139d739>] port_fops_splice_write+0xe9/0x140 [<ffffffff8127a3f4>] ? selinux_file_permission+0xc4/0x120 [<ffffffff8139d650>] ? wait_port_writable+0x1b0/0x1b0 [<ffffffff811a6fe0>] do_splice_from+0xa0/0x110 [<ffffffff811a951f>] SyS_splice+0x5ff/0x6b0 [<ffffffff8161facf>] tracesys+0xdd/0xe2 Code...

...et; } +#endif /* #ifdef CONFIG_SYSCALL_SPLICE */ static unsigned int port_fops_poll(struct file *filp, poll_table *wait) { @@ -1109,7 +1111,7 @@ static const struct file_operations port_fops = { .open = port_fops_open, .read = port_fops_read, .write = port_fops_write, - .splice_write = port_fops_splice_write, + SPLICE_WRITE_INIT(port_fops_splice_write) .poll = port_fops_poll, .release = port_fops_release, .fasync = port_fops_fasync, -- 1.9.1

...et; } +#endif /* #ifdef CONFIG_SYSCALL_SPLICE */ static unsigned int port_fops_poll(struct file *filp, poll_table *wait) { @@ -1109,7 +1111,7 @@ static const struct file_operations port_fops = { .open = port_fops_open, .read = port_fops_read, .write = port_fops_write, - .splice_write = port_fops_splice_write, + SPLICE_WRITE_INIT(port_fops_splice_write) .poll = port_fops_poll, .release = port_fops_release, .fasync = port_fops_fasync, -- 1.9.1

...00000000ffff0ff0 DR7: 0000000000000400 Stack: ffff880071c8ef48 ffff88007bf25e20 ffff88007bf25e88 ffffffff8139d6fa ffff88007bf25e28 ffffffff8127a3f4 0000000000000000 0000000000000000 ffff880071c8ef48 0000100000000000 0000000000000003 ffff88007bf25e08 Call Trace: [<ffffffff8139d6fa>] port_fops_splice_write+0xaa/0x130 [<ffffffff8127a3f4>] ? selinux_file_permission+0xc4/0x120 [<ffffffff8139d650>] ? wait_port_writable+0x1b0/0x1b0 [<ffffffff811a6fe0>] do_splice_from+0xa0/0x110 [<ffffffff811a951f>] SyS_splice+0x5ff/0x6b0 [<ffffffff8161f8c2>] system_call_fastpath+0x1...

...file *filp, const char __user *ubuf, > > count = min((size_t)(32 * 1024), count); > > - buf = alloc_buf(port->out_vq, count, 0); > + buf = alloc_buf(port->portdev->vdev, count, 0); > if (!buf) > return -ENOMEM; > > @@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, > if (ret < 0) > goto error_out; > > - buf = alloc_buf(port->out_vq, 0, pipe->nrbufs); > + buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs); > if (!buf) { > ret = -ENOMEM; > goto error_out; > @@ -1374,7 +...

...file *filp, const char __user *ubuf, > > count = min((size_t)(32 * 1024), count); > > - buf = alloc_buf(port->out_vq, count, 0); > + buf = alloc_buf(port->portdev->vdev, count, 0); > if (!buf) > return -ENOMEM; > > @@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, > if (ret < 0) > goto error_out; > > - buf = alloc_buf(port->out_vq, 0, pipe->nrbufs); > + buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs); > if (!buf) { > ret = -ENOMEM; > goto error_out; > @@ -1374,7 +...

From: Sjur Br?ndeland <sjur.brandeland at stericsson.com> This patch-set introduces a new virtio type "rproc_serial" for communicating with remote processors over shared memory. The driver depends on the the remoteproc framework. As preparation for introducing "rproc_serial" I've done a refactoring of the transmit buffer handling. This patch-set is a rework of the

From: Sjur Br?ndeland <sjur.brandeland at stericsson.com> This patch-set introduces a new virtio type "rproc_serial" for communicating with remote processors over shared memory. The driver depends on the the remoteproc framework. As preparation for introducing "rproc_serial" I've done a refactoring of the transmit buffer handling. This patch-set is a rework of the

This patch-set introduces a new virtio type "rproc_serial" for communicating with remote processors over shared memory. The driver depends on the the remoteproc framework. As preparation for introducing "rproc_serial" I've done a refactoring of the transmit buffer handling. NOTE: These two patches are identical to first two patches of the V8 patch-set, but are rebased to

This patch-set introduces a new virtio type "rproc_serial" for communicating with remote processors over shared memory. The driver depends on the the remoteproc framework. As preparation for introducing "rproc_serial" I've done a refactoring of the transmit buffer handling. NOTE: These two patches are identical to first two patches of the V8 patch-set, but are rebased to

From: Sjur Br?ndeland <sjur.brandeland at stericsson.com> This patch-set introduces a new virtio type "rproc_serial" for communicating with remote processors over shared memory. The driver depends on the the remoteproc framework. As preparation for introducing "rproc_serial" I've done a refactoring of the transmit buffer handling. Changes since v7: - Rebased to

From: Sjur Br?ndeland <sjur.brandeland at stericsson.com> This patch-set introduces a new virtio type "rproc_serial" for communicating with remote processors over shared memory. The driver depends on the the remoteproc framework. As preparation for introducing "rproc_serial" I've done a refactoring of the transmit buffer handling. Changes since v7: - Rebased to

...Use kmalloc_array() in init_vqs() > Less function calls in init_vqs() after error detection > Rename a jump label in init() > Rename jump labels in virtcons_probe() > Rename jump labels in add_port() > Rename a jump label in port_fops_open() > Rename a jump label in port_fops_splice_write() > Rename jump labels in port_fops_write() > Rename a jump label in __send_to_port() > Rename jump labels in alloc_buf() > Rename a jump label in five functions > > drivers/char/virtio_console.c | 155 ++++++++++++++++++++++++------------------ > 1 file changed, 87 i...

...38,7 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf, count = min((size_t)(32 * 1024), count); - buf = alloc_buf(port->out_vq, count, 0); + buf = alloc_buf(port->portdev->vdev, count, 0); if (!buf) return -ENOMEM; @@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, if (ret < 0) goto error_out; - buf = alloc_buf(port->out_vq, 0, pipe->nrbufs); + buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs); if (!buf) { ret = -ENOMEM; goto error_out; @@ -1374,7 +1374,7 @@ static unsigned int fill_queue(stru...

...Use kmalloc_array() in init_vqs() > Less function calls in init_vqs() after error detection > Rename a jump label in init() > Rename jump labels in virtcons_probe() > Rename jump labels in add_port() > Rename a jump label in port_fops_open() > Rename a jump label in port_fops_splice_write() > Rename jump labels in port_fops_write() > Rename a jump label in __send_to_port() > Rename jump labels in alloc_buf() > Rename a jump label in five functions > > drivers/char/virtio_console.c | 155 ++++++++++++++++++++++++------------------ > 1 file changed, 87 i...

...t; > > count = min((size_t)(32 * 1024), count); > > > > - buf = alloc_buf(port->out_vq, count, 0); > > + buf = alloc_buf(port->portdev->vdev, count, 0); > > if (!buf) > > return -ENOMEM; > > > > @@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, > > if (ret < 0) > > goto error_out; > > > > - buf = alloc_buf(port->out_vq, 0, pipe->nrbufs); > > + buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs); > > if (!buf) { > > ret = -ENOMEM; > &...