Commit 60811d0f authored by Benjamin Coddington's avatar Benjamin Coddington Committed by Greg Kroah-Hartman

vhost/scsi: fix reuse of &vq->iov[out] in response

commit a77ec83a upstream.

The address of the iovec &vq->iov[out] is not guaranteed to contain the scsi
command's response iovec throughout the lifetime of the command.  Rather, it
is more likely to contain an iovec from an immediately following command
after looping back around to vhost_get_vq_desc().  Pass along the iovec
entirely instead.

Fixes: 79c14141 ("vhost/scsi: Convert completion path to use copy_to_iter")
Signed-off-by: default avatarBenjamin Coddington <bcodding@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 045cb95c
...@@ -88,7 +88,7 @@ struct vhost_scsi_cmd { ...@@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
struct scatterlist *tvc_prot_sgl; struct scatterlist *tvc_prot_sgl;
struct page **tvc_upages; struct page **tvc_upages;
/* Pointer to response header iovec */ /* Pointer to response header iovec */
struct iovec *tvc_resp_iov; struct iovec tvc_resp_iov;
/* Pointer to vhost_scsi for our device */ /* Pointer to vhost_scsi for our device */
struct vhost_scsi *tvc_vhost; struct vhost_scsi *tvc_vhost;
/* Pointer to vhost_virtqueue for the cmd */ /* Pointer to vhost_virtqueue for the cmd */
...@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) ...@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
memcpy(v_rsp.sense, cmd->tvc_sense_buf, memcpy(v_rsp.sense, cmd->tvc_sense_buf,
se_cmd->scsi_sense_length); se_cmd->scsi_sense_length);
iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov, iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
cmd->tvc_in_iovs, sizeof(v_rsp)); cmd->tvc_in_iovs, sizeof(v_rsp));
ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
if (likely(ret == sizeof(v_rsp))) { if (likely(ret == sizeof(v_rsp))) {
...@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) ...@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
} }
cmd->tvc_vhost = vs; cmd->tvc_vhost = vs;
cmd->tvc_vq = vq; cmd->tvc_vq = vq;
cmd->tvc_resp_iov = &vq->iov[out]; cmd->tvc_resp_iov = vq->iov[out];
cmd->tvc_in_iovs = in; cmd->tvc_in_iovs = in;
pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n", pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment