lkml.org 
[lkml]   [2013]   [Nov]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 32/74] vhost/scsi: Fix incorrect usage of get_user_pages_fast write parameter
    Date
    3.10-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Nicholas Bellinger <nab@linux-iscsi.org>

    commit 60a01f558af9c48b0bb31f303c479e32721add3f upstream.

    This patch addresses a long-standing bug where the get_user_pages_fast()
    write parameter used for setting the underlying page table entry permission
    bits was incorrectly set to write=1 for data_direction=DMA_TO_DEVICE, and
    passed into get_user_pages_fast() via vhost_scsi_map_iov_to_sgl().

    However, this parameter is intended to signal WRITEs to pinned userspace
    PTEs for the virtio-scsi DMA_FROM_DEVICE -> READ payload case, and *not*
    for the virtio-scsi DMA_TO_DEVICE -> WRITE payload case.

    This bug would manifest itself as random process segmentation faults on
    KVM host after repeated vhost starts + stops and/or with lots of vhost
    endpoints + LUNs.

    Cc: Stefan Hajnoczi <stefanha@redhat.com>
    Cc: Michael S. Tsirkin <mst@redhat.com>
    Cc: Asias He <asias@redhat.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/vhost/scsi.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/vhost/scsi.c
    +++ b/drivers/vhost/scsi.c
    @@ -1017,7 +1017,7 @@ static void vhost_scsi_handle_vq(struct
    if (data_direction != DMA_NONE) {
    ret = vhost_scsi_map_iov_to_sgl(tv_cmd,
    &vq->iov[data_first], data_num,
    - data_direction == DMA_TO_DEVICE);
    + data_direction == DMA_FROM_DEVICE);
    if (unlikely(ret)) {
    vq_err(vq, "Failed to map iov to sgl\n");
    goto err_free;



    \
     
     \ /
      Last update: 2013-11-09 10:21    [W:4.119 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site