search for: vp_modern_find_vq

...2001 > From: Jason Wang <jasowang at redhat.com> > Date: Thu, 23 Mar 2017 13:07:16 +0800 > Subject: [PATCH] virtio_pci: fix out of bound access for msix_names > > Signed-off-by: Jason Wang <jasowang at redhat.com> I tested this, and it does appear to fix the crashes in vp_modern_find_vqs. Therefore: Tested-by: Richard W.M. Jones <rjones at redhat.com> Thanks, Rich. > drivers/virtio/virtio_pci_common.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c &gt...

...2001 > From: Jason Wang <jasowang at redhat.com> > Date: Thu, 23 Mar 2017 13:07:16 +0800 > Subject: [PATCH] virtio_pci: fix out of bound access for msix_names > > Signed-off-by: Jason Wang <jasowang at redhat.com> I tested this, and it does appear to fix the crashes in vp_modern_find_vqs. Therefore: Tested-by: Richard W.M. Jones <rjones at redhat.com> Thanks, Rich. > drivers/virtio/virtio_pci_common.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c &gt...

.../* Check if queue is either not available or already active. */ num = ioread16(&cfg->queue_size); - if (!num || ioread8(&cfg->queue_enable)) + if (!num || ioread16(&cfg->queue_enable)) return ERR_PTR(-ENOENT); if (num & (num - 1)) { @@ -394,7 +394,7 @@ static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs, */ list_for_each_entry(vq, &vdev->vqs, list) { iowrite16(vq->index, &vp_dev->common->queue_select); - iowrite8(1, &vp_dev->common->queue_enable); + iowrite16(1, &vp_dev->common->queue_enable); } retu...

.../* Check if queue is either not available or already active. */ num = ioread16(&cfg->queue_size); - if (!num || ioread8(&cfg->queue_enable)) + if (!num || ioread16(&cfg->queue_enable)) return ERR_PTR(-ENOENT); if (num & (num - 1)) { @@ -394,7 +394,7 @@ static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs, */ list_for_each_entry(vq, &vdev->vqs, list) { iowrite16(vq->index, &vp_dev->common->queue_select); - iowrite8(1, &vp_dev->common->queue_enable); + iowrite16(1, &vp_dev->common->queue_enable); } retu...

...owang at redhat.com> > > Date: Thu, 23 Mar 2017 13:07:16 +0800 > > Subject: [PATCH] virtio_pci: fix out of bound access for msix_names > > > > Signed-off-by: Jason Wang <jasowang at redhat.com> > > I tested this, and it does appear to fix the crashes in > vp_modern_find_vqs. Therefore: > > Tested-by: Richard W.M. Jones <rjones at redhat.com> > > Thanks, > > Rich. I've queued the fix, thanks everyone! > > drivers/virtio/virtio_pci_common.c | 9 +++++---- > > 1 file changed, 5 insertions(+), 4 deletions(-) > > >...

...evice *vdev); /* Setup the affinity for a virtqueue: diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c index 8e5cf19..c0c11fa 100644 --- a/drivers/virtio/virtio_pci_modern.c +++ b/drivers/virtio/virtio_pci_modern.c @@ -418,7 +418,7 @@ err_new_queue: static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs, struct virtqueue *vqs[], vq_callback_t *callbacks[], - const char *names[]) + const char * const names[]) { struct virtio_pci_device *vp_dev = to_vp_device(vdev); struct virtqueue *vq; diff --git a/include/linux/vi...

...evice *vdev); /* Setup the affinity for a virtqueue: diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c index 8e5cf19..c0c11fa 100644 --- a/drivers/virtio/virtio_pci_modern.c +++ b/drivers/virtio/virtio_pci_modern.c @@ -418,7 +418,7 @@ err_new_queue: static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs, struct virtqueue *vqs[], vq_callback_t *callbacks[], - const char *names[]) + const char * const names[]) { struct virtio_pci_device *vp_dev = to_vp_device(vdev); struct virtqueue *vq; diff --git a/include/linux/vi...

...} + + return vq; + +out_assign: + if (!vp_dev->notify_base) + pci_iounmap(vp_dev->pci_dev, (void __iomem __force *)vq->priv); +out_map: + vring_del_virtqueue(vq); +out_activate_queue: + free_pages_exact(info->queue, vring_pci_size(info->num)); + return ERR_PTR(err); +} + +static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs, + struct virtqueue *vqs[], + vq_callback_t *callbacks[], + const char *names[]) +{ + struct virtio_pci_device *vp_dev = to_vp_device(vdev); + struct virtqueue *vq; + int rc = vp_find_vqs(vdev, nvqs, vqs, callbacks, names); + + if (...

...} + + return vq; + +out_assign: + if (!vp_dev->notify_base) + pci_iounmap(vp_dev->pci_dev, (void __iomem __force *)vq->priv); +out_map: + vring_del_virtqueue(vq); +out_activate_queue: + free_pages_exact(info->queue, vring_pci_size(info->num)); + return ERR_PTR(err); +} + +static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs, + struct virtqueue *vqs[], + vq_callback_t *callbacks[], + const char *names[]) +{ + struct virtio_pci_device *vp_dev = to_vp_device(vdev); + struct virtqueue *vq; + int rc = vp_find_vqs(vdev, nvqs, vqs, callbacks, names); + + if (...

On 2017?02?06? 01:15, Christoph Hellwig wrote: > We don't really need struct virtio_pci_vq_info, as most field in there > are redundant: > > - the vq backpointer is not strictly neede to start with > - the entry in the vqs list is not needed - the generic virtqueue already > has list, we only need to check if it has a callback to get the same > semantics >

On 2017?02?06? 01:15, Christoph Hellwig wrote: > We don't really need struct virtio_pci_vq_info, as most field in there > are redundant: > > - the vq backpointer is not strictly neede to start with > - the entry in the vqs list is not needed - the generic virtqueue already > has list, we only need to check if it has a callback to get the same > semantics >

This is just repost of all patches with fixups squashed in - convenient if you just want to remove old ones from queue and apply new ones. I also tweaked commit log for patch "virtio_pci: modern driver" I also included Gerd's tag: Tested-by: Gerd Hoffmann <kraxel at redhat.com> You can find it all before the rebase -i --autosquash in my tree:

This is just repost of all patches with fixups squashed in - convenient if you just want to remove old ones from queue and apply new ones. I also tweaked commit log for patch "virtio_pci: modern driver" I also included Gerd's tag: Tested-by: Gerd Hoffmann <kraxel at redhat.com> You can find it all before the rebase -i --autosquash in my tree:

Hi, Fedora has received multiple reports of crashes when running 4.11 as a guest https://bugzilla.redhat.com/show_bug.cgi?id=1430297 https://bugzilla.redhat.com/show_bug.cgi?id=1434462 https://bugzilla.kernel.org/show_bug.cgi?id=194911 https://bugzilla.redhat.com/show_bug.cgi?id=1433899 The crashes are not always consistent but they are generally some flavor of oops or GPF in virtio related

Hi, Fedora has received multiple reports of crashes when running 4.11 as a guest https://bugzilla.redhat.com/show_bug.cgi?id=1430297 https://bugzilla.redhat.com/show_bug.cgi?id=1434462 https://bugzilla.kernel.org/show_bug.cgi?id=194911 https://bugzilla.redhat.com/show_bug.cgi?id=1433899 The crashes are not always consistent but they are generally some flavor of oops or GPF in virtio related

...e *vp_dev, /* get offset of notification word for this vq */ off = vp_ioread16(&cfg->queue_notify_off); - info->msix_vector = msix_vec; - /* create the vring */ vq = vring_create_virtqueue(index, num, SMP_CACHE_BYTES, &vp_dev->vdev, @@ -409,9 +406,8 @@ static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs, return 0; } -static void del_vq(struct virtio_pci_vq_info *info) +static void del_vq(struct virtqueue *vq) { - struct virtqueue *vq = info->vq; struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev); vp_iowrite16(vq->index, &vp...

...e *vp_dev, /* get offset of notification word for this vq */ off = vp_ioread16(&cfg->queue_notify_off); - info->msix_vector = msix_vec; - /* create the vring */ vq = vring_create_virtqueue(index, num, SMP_CACHE_BYTES, &vp_dev->vdev, @@ -409,9 +406,8 @@ static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs, return 0; } -static void del_vq(struct virtio_pci_vq_info *info) +static void del_vq(struct virtqueue *vq) { - struct virtqueue *vq = info->vq; struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev); vp_iowrite16(vq->index, &vp...

...e *vp_dev, /* get offset of notification word for this vq */ off = vp_ioread16(&cfg->queue_notify_off); - info->msix_vector = msix_vec; - /* create the vring */ vq = vring_create_virtqueue(index, num, SMP_CACHE_BYTES, &vp_dev->vdev, @@ -409,9 +406,8 @@ static int vp_modern_find_vqs(struct virtio_device *vdev, unsigned nvqs, return 0; } -static void del_vq(struct virtio_pci_vq_info *info) +static void del_vq(struct virtqueue *vq) { - struct virtqueue *vq = info->vq; struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev); vp_iowrite16(vq->index, &vp...

The spec is very clear on this: 4.1.3.1 Driver Requirements: PCI Device Layout The driver MUST access each field using the ?natural? access method, i.e. 32-bit accesses for 32-bit fields, 16-bit accesses for 16-bit fields and 8-bit accesses for 8-bit fields. Add type-safe wrappers to prevent access with incorrect width. Signed-off-by: Michael S. Tsirkin <mst at redhat.com> ---

The spec is very clear on this: 4.1.3.1 Driver Requirements: PCI Device Layout The driver MUST access each field using the ?natural? access method, i.e. 32-bit accesses for 32-bit fields, 16-bit accesses for 16-bit fields and 8-bit accesses for 8-bit fields. Add type-safe wrappers to prevent access with incorrect width. Signed-off-by: Michael S. Tsirkin <mst at redhat.com> ---