search for: virtio_scsi_s_function_reject

On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > + memset(&rsp, 0, sizeof(rsp)); > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > + resp = vq->iov[out].iov_base; > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > Is it actually safe to trust that iov_base has passed an earlier > access_ok() check here? Why not just use copy_to_user() instead? Good point. We really should have remov...

On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > + memset(&rsp, 0, sizeof(rsp)); > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > + resp = vq->iov[out].iov_base; > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > Is it actually safe to trust that iov_base has passed an earlier > access_ok() check here? Why not just use copy_to_user() instead? Good point. We really should have remov...

The following changes since commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d: Linux 4.19 (2018-10-22 07:37:37 +0100) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus for you to fetch changes up to 79f800b2e76923cd8ce0aa659cb5c019d9643bc9: MAINTAINERS: remove reference to bogus vsock file (2018-10-24 21:16:14 -0400)

The following changes since commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d: Linux 4.19 (2018-10-22 07:37:37 +0100) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus for you to fetch changes up to 79f800b2e76923cd8ce0aa659cb5c019d9643bc9: MAINTAINERS: remove reference to bogus vsock file (2018-10-24 21:16:14 -0400)

...queue *vq, + int head, unsigned int out) +{ + struct virtio_scsi_ctrl_tmf_resp __user *resp; + struct virtio_scsi_ctrl_tmf_resp rsp; + int ret; + + pr_debug("%s\n", __func__); + memset(&rsp, 0, sizeof(rsp)); + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; + resp = vq->iov[out].iov_base; + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); Is it actually safe to trust that iov_base has passed an earlier access_ok() check here? Why not just use copy_to_user() instead? -Kees > vhost/scsi: Extract common handling code from...

On Thu, Nov 01, 2018 at 04:06:19PM -0700, Linus Torvalds wrote: > On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > > > + memset(&rsp, 0, sizeof(rsp)); > > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > > + resp = vq->iov[out].iov_base; > > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > > > Is it actually safe to trust that iov_base has passed an earlier > > access_ok() check here? Why not just use copy_to_user() instead? > > Good...

...ichael S. Tsirkin wrote: > > On Thu, Nov 01, 2018 at 04:06:19PM -0700, Linus Torvalds wrote: > > > On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > > > + memset(&rsp, 0, sizeof(rsp)); > > > > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > > > > + resp = vq->iov[out].iov_base; > > > > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > > > > > > > Is it actually safe to trust that iov_base has passed an earlier > > > > access_ok() check here? Why no...

...AM +0000, Mark Rutland wrote: > On Thu, Nov 01, 2018 at 04:06:19PM -0700, Linus Torvalds wrote: > > On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > > > > > + memset(&rsp, 0, sizeof(rsp)); > > > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > > > + resp = vq->iov[out].iov_base; > > > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > > > > > Is it actually safe to trust that iov_base has passed an earlier > > > access_ok() check here? Why not just use copy_to_user()...

...AM +0000, Mark Rutland wrote: > On Thu, Nov 01, 2018 at 04:06:19PM -0700, Linus Torvalds wrote: > > On Thu, Nov 1, 2018 at 4:00 PM Kees Cook <keescook at chromium.org> wrote: > > > > > > + memset(&rsp, 0, sizeof(rsp)); > > > + rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED; > > > + resp = vq->iov[out].iov_base; > > > + ret = __copy_to_user(resp, &rsp, sizeof(rsp)); > > > > > > Is it actually safe to trust that iov_base has passed an earlier > > > access_ok() check here? Why not just use copy_to_user()...

...42 1322573683 + +#define VIRTIO_SCSI_S_FUNCTION_COMPLETE 0 +\end_layout + +\begin_layout Plain Layout + +\change_inserted 1531152142 1322665370 + +#define VIRTIO_SCSI_S_FUNCTION_SUCCEEDED 10 +\end_layout + +\begin_layout Plain Layout + +\change_inserted 1531152142 1322665370 + +#define VIRTIO_SCSI_S_FUNCTION_REJECTED 11 +\end_layout + +\end_inset + + +\end_layout + +\begin_deeper +\begin_layout Standard + +\change_inserted 1531152142 1322725968 +The type is VIRTIO_SCSI_T_TMF; the subtype field defines. + All fields except +\series bold +response +\series default + are filled by the driver. + The +\se...

...42 1322573683 + +#define VIRTIO_SCSI_S_FUNCTION_COMPLETE 0 +\end_layout + +\begin_layout Plain Layout + +\change_inserted 1531152142 1322665370 + +#define VIRTIO_SCSI_S_FUNCTION_SUCCEEDED 10 +\end_layout + +\begin_layout Plain Layout + +\change_inserted 1531152142 1322665370 + +#define VIRTIO_SCSI_S_FUNCTION_REJECTED 11 +\end_layout + +\end_inset + + +\end_layout + +\begin_deeper +\begin_layout Standard + +\change_inserted 1531152142 1322725968 +The type is VIRTIO_SCSI_T_TMF; the subtype field defines. + All fields except +\series bold +response +\series default + are filled by the driver. + The +\se...

This is on top of Paolo and Nick's work. Current status: Works now (guest boots fine, no hang any more) with seabios's virtio-scsi disabled. Rebased to latest qemu.org/master Change details are in commit log. TODO: Make seabios happy. Paolo Bonzini (2): virtio-scsi: create VirtIOSCSICommon vhost-scsi: new device supporting the tcm_vhost Linux kernel module hw/Makefile.objs

This is on top of Paolo and Nick's work. Current status: Works now (guest boots fine, no hang any more) with seabios's virtio-scsi disabled. Rebased to latest qemu.org/master Change details are in commit log. TODO: Make seabios happy. Paolo Bonzini (2): virtio-scsi: create VirtIOSCSICommon vhost-scsi: new device supporting the tcm_vhost Linux kernel module hw/Makefile.objs

This is on top of Paolo and Nick's work. Current status: Basically, tcm_vhost + seabios works now. We still have one more issue, vhost_verify_ring_mappings fails. The hotplug also works with the latest tcm_vhost.ko hotplug patch. Asias He (1): disable vhost_verify_ring_mappings check Paolo Bonzini (2): virtio-scsi: create VirtIOSCSICommon vhost-scsi: new device supporting the

This is on top of Paolo and Nick's work. Current status: Basically, tcm_vhost + seabios works now. We still have one more issue, vhost_verify_ring_mappings fails. The hotplug also works with the latest tcm_vhost.ko hotplug patch. Asias He (1): disable vhost_verify_ring_mappings check Paolo Bonzini (2): virtio-scsi: create VirtIOSCSICommon vhost-scsi: new device supporting the

From: Nicholas Bellinger <nab at linux-iscsi.org> Hi QEMU folks, The following is the patch series to support vhost-scsi-pci within the upstream QEMU tree. This includes the refactoring of existing virtio-scsi code from Paolo to allow a VirtIOSCSICommon structure that is shared amoungst existing virtio-scsi-pci device and new vhost-scsi-pci device code. Currently this code requires

From: Nicholas Bellinger <nab at linux-iscsi.org> Hi QEMU folks, The following is the patch series to support vhost-scsi-pci within the upstream QEMU tree. This includes the refactoring of existing virtio-scsi code from Paolo to allow a VirtIOSCSICommon structure that is shared amoungst existing virtio-scsi-pci device and new vhost-scsi-pci device code. Currently this code requires

From: Nicholas Bellinger <nab at linux-iscsi.org> Hi QEMU folks, The following is the patch-v2 series to support vhost-scsi-pci within the upstream QEMU tree. This includes the refactoring of existing virtio-scsi code from Paolo to allow a VirtIOSCSICommon structure that is shared amoungst existing virtio-scsi-pci device and new vhost-scsi-pci device code. Currently this code requires

From: Nicholas Bellinger <nab at linux-iscsi.org> Hi QEMU folks, The following is the patch-v2 series to support vhost-scsi-pci within the upstream QEMU tree. This includes the refactoring of existing virtio-scsi code from Paolo to allow a VirtIOSCSICommon structure that is shared amoungst existing virtio-scsi-pci device and new vhost-scsi-pci device code. Currently this code requires

...u8 lun[8]; u64 id; u8 additional[]; u8 response; } /* command-specific response values */ #define VIRTIO_SCSI_S_FUNCTION_COMPLETE 0 #define VIRTIO_SCSI_S_FAILURE 3 #define VIRTIO_SCSI_S_FUNCTION_SUCCEEDED 4 #define VIRTIO_SCSI_S_FUNCTION_REJECTED 5 #define VIRTIO_SCSI_S_INCORRECT_LUN 6 The type is VIRTIO_SCSI_T_TMF. All fields but the last one are filled by the driver, the response field is filled in by the device. The id command must match the id in a SCSI command. Irrelevant fields for the reques...