vhost/scsi: fix reuse of &vq->iov[out] in response (a77ec83a) · Commits · 戴 / test

The address of the iovec &vq->iov[out] is not guaranteed to contain the scsi command's response iovec throughout the lifetime of the command. Rather, it is more likely to contain an iovec from an immediately following command after looping back around to vhost_get_vq_desc(). Pass along the iovec entirely instead. Fixes: ("vhost/scsi: Convert completion path to use copy_to_iter") Cc: stable@vger.kernel.org Signed-off-by:

Benjamin Coddington <bcodding@redhat.com> Signed-off-by:

Michael S. Tsirkin <mst@redhat.com>

drivers/vhost/scsi.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
		struct scatterlist *tvc_prot_sgl;
		struct page **tvc_upages;
		/* Pointer to response header iovec */
		struct iovec *tvc_resp_iov;
		struct iovec tvc_resp_iov;
		/* Pointer to vhost_scsi for our device */
		struct vhost_scsi *tvc_vhost;
		/* Pointer to vhost_virtqueue for the cmd */
		@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
		memcpy(v_rsp.sense, cmd->tvc_sense_buf,
		se_cmd->scsi_sense_length);

		iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov,
		iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
		cmd->tvc_in_iovs, sizeof(v_rsp));
		ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
		if (likely(ret == sizeof(v_rsp))) {
		@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi vs, struct vhost_virtqueue vq)
		}
		cmd->tvc_vhost = vs;
		cmd->tvc_vq = vq;
		cmd->tvc_resp_iov = &vq->iov[out];
		cmd->tvc_resp_iov = vq->iov[out];
		cmd->tvc_in_iovs = in;

		pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",

Admin message