[Xen-changelog] [qemu-xen stable-4.10] vhost: fix error check in vhost_verify_ring_mappings()

[patchbot@xxxxxxx]

commit 82ded5166b82c16978526fe748db771c19efb794
Author:     Greg Kurz <groug@xxxxxxxx>
AuthorDate: Thu Nov 30 22:39:59 2017 +0100
Commit:     Michael Roth <mdroth@xxxxxxxxxxxxxxxxxx>
CommitDate: Wed Dec 6 11:47:33 2017 -0600

    vhost: fix error check in vhost_verify_ring_mappings()
    
    Since commit f1f9e6c5 "vhost: adapt vhost_verify_ring_mappings() to
    virtio 1 ring layout", we check the mapping of each part (descriptor
    table, available ring and used ring) of each virtqueue separately.
    
    The checking of a part is done by the vhost_verify_ring_part_mapping()
    function: it returns either 0 on success or a negative errno if the
    part cannot be mapped at the same place.
    
    Unfortunately, the vhost_verify_ring_mappings() function checks its
    return value the other way round. It means that we either:
    - only verify the descriptor table of the first virtqueue, and if it
      is valid we ignore all the other mappings
    - or ignore all broken mappings until we reach a valid one
    
    ie, we only raise an error if all mappings are broken, and we consider
    all mappings are valid otherwise (false success), which is obviously
    wrong.
    
    This patch ensures that vhost_verify_ring_mappings() only returns
    success if ALL mappings are okay.
    
    Reported-by: Dr. David Alan Gilbert <dgilbert@xxxxxxxxxx>
    Signed-off-by: Greg Kurz <groug@xxxxxxxx>
    Reviewed-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    (cherry picked from commit 2fe45ec3bffbd3a26f2ed39f60bab0ca5217d8f6)
    Signed-off-by: Michael Roth <mdroth@xxxxxxxxxxxxxxxxxx>
---
 hw/virtio/vhost.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 76f6e1f..fd6f4a8 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -492,21 +492,21 @@ static int vhost_verify_ring_mappings(struct vhost_dev 
*dev,
         j = 0;
         r = vhost_verify_ring_part_mapping(dev, vq->desc, vq->desc_phys,
                                            vq->desc_size, start_addr, size);
-        if (!r) {
+        if (r) {
             break;
         }
 
         j++;
         r = vhost_verify_ring_part_mapping(dev, vq->avail, vq->avail_phys,
                                            vq->avail_size, start_addr, size);
-        if (!r) {
+        if (r) {
             break;
         }
 
         j++;
         r = vhost_verify_ring_part_mapping(dev, vq->used, vq->used_phys,
                                            vq->used_size, start_addr, size);
-        if (!r) {
+        if (r) {
             break;
         }
     }
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.10

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog