Commit d14d2b78 authored Apr 11, 2018 by Stefan Hajnoczi Committed by David S. Miller Apr 11, 2018

vhost: fix vhost_vq_access_ok() log check



Commit d65026c6 ("vhost: validate log
when IOTLB is enabled") introduced a regression.  The logic was
originally:

  if (vq->iotlb)
      return 1;
  return A && B;

After the patch the short-circuit logic for A was inverted:

  if (A || vq->iotlb)
      return A;
  return B;

This patch fixes the regression by rewriting the checks in the obvious
way, no longer returning A when vq->iotlb is non-NULL (which is hard to
understand).

Reported-by:  <syzbot+65a84dde0214b0387ccd@syzkaller.appspotmail.com>
Cc: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 7ced6c98

drivers/vhost/vhost.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -1244,10 +1244,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq,
		/* Caller should have vq mutex and device mutex */
		int vhost_vq_access_ok(struct vhost_virtqueue *vq)
		{
		int ret = vq_log_access_ok(vq, vq->log_base);
		if (!vq_log_access_ok(vq, vq->log_base))
		return 0;

		if (ret \|\| vq->iotlb)
		return ret;
		/* Access validation occurs at prefetch time with IOTLB */
		if (vq->iotlb)
		return 1;

		return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used);
		}