search for: vhost_page_size

When counting pages we should increase it by 1 instead of VHOST_PAGE_SIZE, and also make log_write() can correctly process the request across pages with write_address not start at page boundary. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/vhost.c | 20 +++++++++----------- 1 files changed, 9 insertions(+), 11 deletions(-) diff --git a/...

When counting pages we should increase it by 1 instead of VHOST_PAGE_SIZE, and also make log_write() can correctly process the request across pages with write_address not start at page boundary. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/vhost.c | 20 +++++++++----------- 1 files changed, 9 insertions(+), 11 deletions(-) diff --git a/...

...); + /* TODO: fallback to kmap() when -ENOSYS? */ + set_page_dirty_lock(page); put_page(page); - return 0; + return r; } -static int log_write(void __user *log_base, +static int log_write(u32 __user *log_base, u64 write_address, u64 write_length) { u64 write_page = write_address / VHOST_PAGE_SIZE; @@ -1726,12 +1727,10 @@ static int log_write(void __user *log_base, return 0; write_length += write_address % VHOST_PAGE_SIZE; for (;;) { - u64 base = (u64)(unsigned long)log_base; - u64 log = base + write_page / 8; - int bit = write_page % 8; - if ((u64)(unsigned long)log != log) - r...

...); + /* TODO: fallback to kmap() when -ENOSYS? */ + set_page_dirty_lock(page); put_page(page); - return 0; + return r; } -static int log_write(void __user *log_base, +static int log_write(u32 __user *log_base, u64 write_address, u64 write_length) { u64 write_page = write_address / VHOST_PAGE_SIZE; @@ -1726,12 +1727,10 @@ static int log_write(void __user *log_base, return 0; write_length += write_address % VHOST_PAGE_SIZE; for (;;) { - u64 base = (u64)(unsigned long)log_base; - u64 log = base + write_page / 8; - int bit = write_page % 8; - if ((u64)(unsigned long)log != log) - r...

...ss_ok(void __user *log_base, u64 addr, unsigned long sz) /* Make sure 64 bit math will not overflow. */ if (a > ULONG_MAX - (unsigned long)log_base || a + (unsigned long)log_base > ULONG_MAX) - return -EFAULT; + return 0; return access_ok(VERIFY_WRITE, log_base + a, (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8);

...ss_ok(void __user *log_base, u64 addr, unsigned long sz) /* Make sure 64 bit math will not overflow. */ if (a > ULONG_MAX - (unsigned long)log_base || a + (unsigned long)log_base > ULONG_MAX) - return -EFAULT; + return 0; return access_ok(VERIFY_WRITE, log_base + a, (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8);

...err; + mutex_unlock(&vhost_log_lock); + } return 0; +err: + mutex_unlock(&vhost_log_lock); + return r; } static int log_write(void __user *log_base, @@ -1725,13 +1731,13 @@ static int log_write(void __user *log_base, if (!write_length) return 0; write_length += write_address % VHOST_PAGE_SIZE; + log_base = (void __user *)((u64)log_base & ~0x3ULL); + write_page += ((u64)log_base & 0x3ULL) * 8; for (;;) { - u64 base = (u64)(unsigned long)log_base; - u64 log = base + write_page / 8; - int bit = write_page % 8; - if ((u64)(unsigned long)log != log) - return -EFAULT; - r = s...

...err; + mutex_unlock(&vhost_log_lock); + } return 0; +err: + mutex_unlock(&vhost_log_lock); + return r; } static int log_write(void __user *log_base, @@ -1725,13 +1731,13 @@ static int log_write(void __user *log_base, if (!write_length) return 0; write_length += write_address % VHOST_PAGE_SIZE; + log_base = (void __user *)((u64)log_base & ~0x3ULL); + write_page += ((u64)log_base & 0x3ULL) * 8; for (;;) { - u64 base = (u64)(unsigned long)log_base; - u64 log = base + write_page / 8; - int bit = write_page % 8; - if ((u64)(unsigned long)log != log) - return -EFAULT; - r = s...

...; set_page_dirty_lock(page); > put_page(page); > - return 0; > + return r; > } > > -static int log_write(void __user *log_base, > +static int log_write(u32 __user *log_base, > u64 write_address, u64 write_length) > { > u64 write_page = write_address / VHOST_PAGE_SIZE; > @@ -1726,12 +1727,10 @@ static int log_write(void __user *log_base, > return 0; > write_length += write_address % VHOST_PAGE_SIZE; > for (;;) { > - u64 base = (u64)(unsigned long)log_base; > - u64 log = base + write_page / 8; > - int bit = write_page % 8; > - i...

v2: * Rewrote the conditional to make the vq access check clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi (2): vhost: fix vhost_vq_access_ok() log check vhost:

v2: * Rewrote the conditional to make the vq access check clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi (2): vhost: fix vhost_vq_access_ok() log check vhost:

...b/drivers/vhost/vhost.c index 29f1675..33e06bf 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -224,6 +224,91 @@ void vhost_dev_cleanup(struct vhost_dev *dev) dev->mm = NULL; } +static int log_access_ok(void __user *log_base, u64 addr, unsigned long sz) +{ + u64 a = addr / VHOST_PAGE_SIZE / 8; + /* Make sure 64 bit math will not overflow. */ + if (a > ULONG_MAX - (unsigned long)log_base || + a + (unsigned long)log_base > ULONG_MAX) + return -EFAULT; + + return access_ok(VERIFY_WRITE, log_base + a, + (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); +} + +/* Caller...

...b/drivers/vhost/vhost.c index 29f1675..33e06bf 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -224,6 +224,91 @@ void vhost_dev_cleanup(struct vhost_dev *dev) dev->mm = NULL; } +static int log_access_ok(void __user *log_base, u64 addr, unsigned long sz) +{ + u64 a = addr / VHOST_PAGE_SIZE / 8; + /* Make sure 64 bit math will not overflow. */ + if (a > ULONG_MAX - (unsigned long)log_base || + a + (unsigned long)log_base > ULONG_MAX) + return -EFAULT; + + return access_ok(VERIFY_WRITE, log_base + a, + (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); +} + +/* Caller...

..._page(page); >> - return 0; >> + return r; >> } >> >> -static int log_write(void __user *log_base, >> +static int log_write(u32 __user *log_base, >> u64 write_address, u64 write_length) >> { >> u64 write_page = write_address / VHOST_PAGE_SIZE; >> @@ -1726,12 +1727,10 @@ static int log_write(void __user *log_base, >> return 0; >> write_length += write_address % VHOST_PAGE_SIZE; >> for (;;) { >> - u64 base = (u64)(unsigned long)log_base; >> - u64 log = base + write_page / 8; >> - int...

..._page(page); >> - return 0; >> + return r; >> } >> >> -static int log_write(void __user *log_base, >> +static int log_write(u32 __user *log_base, >> u64 write_address, u64 write_length) >> { >> u64 write_page = write_address / VHOST_PAGE_SIZE; >> @@ -1726,12 +1727,10 @@ static int log_write(void __user *log_base, >> return 0; >> write_length += write_address % VHOST_PAGE_SIZE; >> for (;;) { >> - u64 base = (u64)(unsigned long)log_base; >> - u64 log = base + write_page / 8; >> - int...

v3: * Rebased onto net/master and resolved conflict [DaveM] v2: * Rewrote the conditional to make the vq access check clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi

v3: * Rebased onto net/master and resolved conflict [DaveM] v2: * Rewrote the conditional to make the vq access check clearer [Linus] * Added Patch 2 to make the return type consistent and harder to misuse [Linus] The first patch fixes the vhost virtqueue access check which was recently broken. The second patch replaces the int return type with bool to prevent future bugs. Stefan Hajnoczi

...host/vhost.c @@ -641,14 +641,14 @@ void vhost_dev_cleanup(struct vhost_dev *dev) } EXPORT_SYMBOL_GPL(vhost_dev_cleanup); -static int log_access_ok(void __user *log_base, u64 addr, unsigned long sz) +static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz) { u64 a = addr / VHOST_PAGE_SIZE / 8; /* Make sure 64 bit math will not overflow. */ if (a > ULONG_MAX - (unsigned long)log_base || a + (unsigned long)log_base > ULONG_MAX) - return 0; + return false; return access_ok(VERIFY_WRITE, log_base + a, (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); @@...

...host/vhost.c @@ -641,14 +641,14 @@ void vhost_dev_cleanup(struct vhost_dev *dev) } EXPORT_SYMBOL_GPL(vhost_dev_cleanup); -static int log_access_ok(void __user *log_base, u64 addr, unsigned long sz) +static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz) { u64 a = addr / VHOST_PAGE_SIZE / 8; /* Make sure 64 bit math will not overflow. */ if (a > ULONG_MAX - (unsigned long)log_base || a + (unsigned long)log_base > ULONG_MAX) - return 0; + return false; return access_ok(VERIFY_WRITE, log_base + a, (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); @@...

...eturn 0; > +err: > + mutex_unlock(&vhost_log_lock); > + return r; > } > > static int log_write(void __user *log_base, > @@ -1725,13 +1731,13 @@ static int log_write(void __user *log_base, > if (!write_length) > return 0; > write_length += write_address % VHOST_PAGE_SIZE; > + log_base = (void __user *)((u64)log_base & ~0x3ULL); > + write_page += ((u64)log_base & 0x3ULL) * 8; > for (;;) { > - u64 base = (u64)(unsigned long)log_base; > - u64 log = base + write_page / 8; > - int bit = write_page % 8; > - if ((u64)(unsigned long)log !...