search for: sockfd_put

Sock will be NULL if we pass -1 to vhost_net_set_backend(), but when we meet errors during ubuf allocation, the code does not check for NULL before calling sockfd_put(), this will lead NULL dereferencing. Fixing by checking sock pointer before. Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support") Reported-by: Dan Carpenter <dan.carpenter at oracle.com> Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 3 ++-...

...7 @@ static int vhost_net_release(struct inode *inode, struct file *f) vhost_net_stop(n, &tx_sock, &rx_sock); vhost_net_flush(n); vhost_dev_stop(&n->dev); - vhost_dev_cleanup(&n->dev, false); + vhost_dev_cleanup(&n->dev); vhost_net_vq_reset(n); if (tx_sock) sockfd_put(tx_sock); diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 71517b3c5558..797d08916553 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -1420,7 +1420,7 @@ static int vhost_scsi_release(struct inode *inode, struct file *f) mutex_unlock(&vs->dev.mutex); vhost_sc...

...7 @@ static int vhost_net_release(struct inode *inode, struct file *f) vhost_net_stop(n, &tx_sock, &rx_sock); vhost_net_flush(n); vhost_dev_stop(&n->dev); - vhost_dev_cleanup(&n->dev, false); + vhost_dev_cleanup(&n->dev); vhost_net_vq_reset(n); if (tx_sock) sockfd_put(tx_sock); diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 2ee2826..c6640d3 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -418,7 +418,7 @@ void vhost_dev_reset_owner(struct vhost_dev *dev, struct vhost_memory *memory) { int i; - vhost_dev_cleanup(dev, true);...

...7 @@ static int vhost_net_release(struct inode *inode, struct file *f) vhost_net_stop(n, &tx_sock, &rx_sock); vhost_net_flush(n); vhost_dev_stop(&n->dev); - vhost_dev_cleanup(&n->dev, false); + vhost_dev_cleanup(&n->dev); vhost_net_vq_reset(n); if (tx_sock) sockfd_put(tx_sock); diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 2ee2826..c6640d3 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -418,7 +418,7 @@ void vhost_dev_reset_owner(struct vhost_dev *dev, struct vhost_memory *memory) { int i; - vhost_dev_cleanup(dev, true);...

...1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index ab11b2bee273..564ead864028 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -1359,7 +1359,7 @@ static int vhost_net_release(struct inode *inode, struct file *f) if (rx_sock) sockfd_put(rx_sock); /* Make sure no callbacks are outstanding */ - synchronize_rcu_bh(); + synchronize_rcu(); /* We do an extra flush before freeing memory, * since jobs can re-queue themselves. */ vhost_net_flush(n);

...7 @@ static int vhost_net_release(struct inode *inode, struct file *f) vhost_net_stop(n, &tx_sock, &rx_sock); vhost_net_flush(n); vhost_dev_stop(&n->dev); - vhost_dev_cleanup(&n->dev, false); + vhost_dev_cleanup(&n->dev); vhost_net_vq_reset(n); if (tx_sock) sockfd_put(tx_sock); diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 2ee2826..c6640d3 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -418,7 +418,7 @@ void vhost_dev_reset_owner(struct vhost_dev *dev, struct vhost_memory *memory) { int i; - vhost_dev_cleanup(dev, true);...

...7 @@ static int vhost_net_release(struct inode *inode, struct file *f) vhost_net_stop(n, &tx_sock, &rx_sock); vhost_net_flush(n); vhost_dev_stop(&n->dev); - vhost_dev_cleanup(&n->dev, false); + vhost_dev_cleanup(&n->dev); vhost_net_vq_reset(n); if (tx_sock) sockfd_put(tx_sock); diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 2ee2826..c6640d3 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -418,7 +418,7 @@ void vhost_dev_reset_owner(struct vhost_dev *dev, struct vhost_memory *memory) { int i; - vhost_dev_cleanup(dev, true);...

...*ikvm, int fd) +{ + struct socket *sock; + int r; + + sock = sockfd_lookup(fd, &r); + if (!sock) { + kvmi_err(ikvm, "Invalid file handle: %d\n", fd); + return false; + } + + ikvm->sock = sock; + + return true; +} + +void kvmi_sock_put(struct kvmi *ikvm) +{ + if (ikvm->sock) + sockfd_put(ikvm->sock); +} + +void kvmi_sock_shutdown(struct kvmi *ikvm) +{ + kernel_sock_shutdown(ikvm->sock, SHUT_RDWR); +} + +bool kvmi_msg_process(struct kvmi *ikvm) +{ + kvmi_info(ikvm, "TODO: %s", __func__); + return false; +}

Hi: This is a new version of trying to enable tx interrupts for virtio-net. We used to try to avoid tx interrupts and orphan packets before transmission for virtio-net. This breaks socket accounting and can lead serveral other side effects e.g: - Several other functions which depends on socket accounting can not work correctly (e.g TCP Small Queue) - No tx completion which make BQL or

Hi: This is a new version of trying to enable tx interrupts for virtio-net. We used to try to avoid tx interrupts and orphan packets before transmission for virtio-net. This breaks socket accounting and can lead serveral other side effects e.g: - Several other functions which depends on socket accounting can not work correctly (e.g TCP Small Queue) - No tx completion which make BQL or

Hello: We used to orphan packets before transmission for virtio-net. This breaks socket accounting and can lead serveral functions won't work, e.g: - Byte Queue Limit depends on tx completion nofication to work. - Packet Generator depends on tx completion nofication for the last transmitted packet to complete. - TCP Small Queue depends on proper accounting of sk_wmem_alloc to work. This

Hello: We used to orphan packets before transmission for virtio-net. This breaks socket accounting and can lead serveral functions won't work, e.g: - Byte Queue Limit depends on tx completion nofication to work. - Packet Generator depends on tx completion nofication for the last transmitted packet to complete. - TCP Small Queue depends on proper accounting of sk_wmem_alloc to work. This

The KVM introspection subsystem provides a facility for applications running on the host or in a separate VM, to control the execution of other VMs (pause, resume, shutdown), query the state of the vCPUs (GPRs, MSRs etc.), alter the page access bits in the shadow page tables (only for the hardware backed ones, eg. Intel's EPT) and receive notifications when events of interest have taken place

The KVM introspection subsystem provides a facility for applications running on the host or in a separate VM, to control the execution of other VMs (pause, resume, shutdown), query the state of the vCPUs (GPRs, MSRs etc.), alter the page access bits in the shadow page tables (only for the hardware backed ones, eg. Intel's EPT) and receive notifications when events of interest have taken place

The KVM introspection subsystem provides a facility for applications running on the host or in a separate VM, to control the execution of other VM-s (pause, resume, shutdown), query the state of the vCPUs (GPRs, MSRs etc.), alter the page access bits in the shadow page tables (only for the hardware backed ones, eg. Intel's EPT) and receive notifications when events of interest have taken place

The KVM introspection subsystem provides a facility for applications running on the host or in a separate VM, to control the execution of other VM-s (pause, resume, shutdown), query the state of the vCPUs (GPRs, MSRs etc.), alter the page access bits in the shadow page tables (only for the hardware backed ones, eg. Intel's EPT) and receive notifications when events of interest have taken place