Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6de7145c authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by Nicholas Bellinger
Browse files

tcm_vhost: Fix vhost_scsi_target structure alignment 



Here TRANSPORT_IQN_LEN is 224, which is a multiple of 4.
Since vhost_tpgt is 2 bytes and abi_version is 4, the total size would
be 230.  But gcc needs struct size be aligned to first field size, which
is 4 bytes, so it pads the structure by extra 2 bytes to the total of
232.

This padding is very undesirable in an ABI:
- it can not be initialized easily
- it can not be checked easily
- it can leak information between kernel and userspace

Simplest solution is probably just to make the padding
explicit.

(v2: Add check for zero'ed backend->reserved field for VHOST_SCSI_SET_ENDPOINT
     and VHOST_SCSI_CLEAR_ENDPOINT ops as requested by MST)

Reported-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 74f4cf29

drivers/vhost/tcm_vhost.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -995,11 +995,15 @@ static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl, 
	case VHOST_SCSI_SET_ENDPOINT:

	case VHOST_SCSI_SET_ENDPOINT:

		if (copy_from_user(&backend, argp, sizeof backend))

		if (copy_from_user(&backend, argp, sizeof backend))

			return -EFAULT;

			return -EFAULT;

		if (backend.reserved != 0)

			return -EOPNOTSUPP;





		return vhost_scsi_set_endpoint(vs, &backend);

		return vhost_scsi_set_endpoint(vs, &backend);

	case VHOST_SCSI_CLEAR_ENDPOINT:

	case VHOST_SCSI_CLEAR_ENDPOINT:

		if (copy_from_user(&backend, argp, sizeof backend))

		if (copy_from_user(&backend, argp, sizeof backend))

			return -EFAULT;

			return -EFAULT;

		if (backend.reserved != 0)

			return -EOPNOTSUPP;





		return vhost_scsi_clear_endpoint(vs, &backend);

		return vhost_scsi_clear_endpoint(vs, &backend);

	case VHOST_SCSI_GET_ABI_VERSION:

	case VHOST_SCSI_GET_ABI_VERSION:

drivers/vhost/tcm_vhost.h

+1 −0
Original line number Original line Diff line number Diff line
@@ -93,6 +93,7 @@ struct vhost_scsi_target { 
	int abi_version;

	int abi_version;

	char vhost_wwpn[TRANSPORT_IQN_LEN];

	char vhost_wwpn[TRANSPORT_IQN_LEN];

	unsigned short vhost_tpgt;

	unsigned short vhost_tpgt;

	unsigned short reserved;

};

};





/* VHOST_SCSI specific defines */

/* VHOST_SCSI specific defines */