vhost: Don't call log_access_ok() when using IOTLB (ab512251) · Commits · 戴 / test

When the IOTLB device is enabled, the log_guest_addr that is passed by userspace to the VHOST_SET_VRING_ADDR ioctl, and which is then written to vq->log_addr, is a GIOVA. All writes to this address are translated by log_user() to writes to an HVA, and then ultimately logged through the corresponding GPAs in log_write_hva(). No logging will ever occur with vq->log_addr in this case. It is thus wrong to pass vq->log_addr and log_guest_addr to log_access_vq() which assumes they are actual GPAs. Introduce a new vq_log_used_access_ok() helper that only checks accesses to the log for the used structure when there isn't an IOTLB device around. Signed-off-by:

Greg Kurz <groug@kaod.org> Link: https://lore.kernel.org/r/160171933385.284610.10189082586063280867.stgit@bahia.lan Signed-off-by:

Michael S. Tsirkin <mst@redhat.com>

drivers/vhost/vhost.c

+18 −5

Original line number	Diff line number	Diff line
		@@ -1370,6 +1370,20 @@ bool vhost_log_access_ok(struct vhost_dev *dev)
		}
		EXPORT_SYMBOL_GPL(vhost_log_access_ok);

		static bool vq_log_used_access_ok(struct vhost_virtqueue *vq,
		void __user *log_base,
		bool log_used,
		u64 log_addr)
		{
		/* If an IOTLB device is present, log_addr is a GIOVA that
		* will never be logged by log_used(). */
		if (vq->iotlb)
		return true;

		return !log_used \|\| log_access_ok(log_base, log_addr,
		vhost_get_used_size(vq, vq->num));
		}

		/* Verify access for write logging. */
		/* Caller should have vq mutex and device mutex */
		static bool vq_log_access_ok(struct vhost_virtqueue *vq,
		@@ -1377,8 +1391,7 @@ static bool vq_log_access_ok(struct vhost_virtqueue *vq,
		{
		return vq_memory_access_ok(log_base, vq->umem,
		vhost_has_feature(vq, VHOST_F_LOG_ALL)) &&
		(!vq->log_used \|\| log_access_ok(log_base, vq->log_addr,
		vhost_get_used_size(vq, vq->num)));
		vq_log_used_access_ok(vq, log_base, vq->log_used, vq->log_addr);
		}

		/* Can we start vq? */
		@@ -1517,9 +1530,9 @@ static long vhost_vring_set_addr(struct vhost_dev *d,
		return -EINVAL;

		/* Also validate log access for used ring if enabled. */
		if ((a.flags & (0x1 << VHOST_VRING_F_LOG)) &&
		!log_access_ok(vq->log_base, a.log_guest_addr,
		vhost_get_used_size(vq, vq->num)))
		if (!vq_log_used_access_ok(vq, vq->log_base,
		a.flags & (0x1 << VHOST_VRING_F_LOG),
		a.log_guest_addr))
		return -EINVAL;
		}

Admin message