Commit 8e5dadfe authored by Bijan Mottahedeh's avatar Bijan Mottahedeh Committed by Michael S. Tsirkin
Browse files

vhost/scsi: Use copy_to_iter() to send control queue response 



Uses copy_to_iter() instead of __copy_to_user() in order to ensure we
support arbitrary layouts and an input buffer split across iov entries.

Fixes: 0d02dbd6 ("vhost/scsi: Respond to control queue operations")
Signed-off-by: default avatarBijan Mottahedeh <bijan.mottahedeh@oracle.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 74ad7419

drivers/vhost/scsi.c

+12 −8
Original line number Diff line number Diff line
@@ -1127,16 +1127,18 @@ vhost_scsi_send_tmf_reject(struct vhost_scsi *vs, 
			   struct vhost_virtqueue *vq,

			   struct vhost_scsi_ctx *vc)

{

	struct virtio_scsi_ctrl_tmf_resp __user *resp;

	struct virtio_scsi_ctrl_tmf_resp rsp;

	struct iov_iter iov_iter;

	int ret;



	pr_debug("%s\n", __func__);

	memset(&rsp, 0, sizeof(rsp));

	rsp.response = VIRTIO_SCSI_S_FUNCTION_REJECTED;

	resp = vq->iov[vc->out].iov_base;

	ret = __copy_to_user(resp, &rsp, sizeof(rsp));

	if (!ret)



	iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));



	ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);

	if (likely(ret == sizeof(rsp)))

		vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);

	else

		pr_err("Faulted on virtio_scsi_ctrl_tmf_resp\n");
@@ -1147,16 +1149,18 @@ vhost_scsi_send_an_resp(struct vhost_scsi *vs, 
			struct vhost_virtqueue *vq,

			struct vhost_scsi_ctx *vc)

{

	struct virtio_scsi_ctrl_an_resp __user *resp;

	struct virtio_scsi_ctrl_an_resp rsp;

	struct iov_iter iov_iter;

	int ret;



	pr_debug("%s\n", __func__);

	memset(&rsp, 0, sizeof(rsp));	/* event_actual = 0 */

	rsp.response = VIRTIO_SCSI_S_OK;

	resp = vq->iov[vc->out].iov_base;

	ret = __copy_to_user(resp, &rsp, sizeof(rsp));

	if (!ret)



	iov_iter_init(&iov_iter, READ, &vq->iov[vc->out], vc->in, sizeof(rsp));



	ret = copy_to_iter(&rsp, sizeof(rsp), &iov_iter);

	if (likely(ret == sizeof(rsp)))

		vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);

	else

		pr_err("Faulted on virtio_scsi_ctrl_an_resp\n");

CRA Git | Maintained and supported by SUSTech CRA and CCSE