virtio_blk: Fix an SG_IO regression (efea2abc) · Commits · 戴 / test

Avoid that submitting an SG_IO ioctl triggers a kernel oops that is preceded by: usercopy: kernel memory overwrite attempt detected to (null) (<null>) (6 bytes) kernel BUG at mm/usercopy.c:72! Reported-by:

Dann Frazier <dann.frazier@canonical.com> Fixes: commit ("block: Make most scsi_req_init() calls implicit") Signed-off-by:

Bart Van Assche <bart.vanassche@wdc.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Dann Frazier <dann.frazier@canonical.com> Cc: <stable@vger.kernel.org> # v4.13 Reviewed-by:

Christoph Hellwig <hch@lst.de> Moved virtblk_initialize_rq() inside CONFIG_VIRTIO_BLK_SCSI. Signed-off-by:

Jens Axboe <axboe@kernel.dk>

drivers/block/virtio_blk.c

+12 −0

Original line number	Original line	Diff line number	Diff line
	@@ -593,10 +593,22 @@ static int virtblk_map_queues(struct blk_mq_tag_set *set)
	return blk_mq_virtio_map_queues(set, vblk->vdev, 0);		return blk_mq_virtio_map_queues(set, vblk->vdev, 0);
	}		}

			#ifdef CONFIG_VIRTIO_BLK_SCSI
			static void virtblk_initialize_rq(struct request *req)
			{
			struct virtblk_req *vbr = blk_mq_rq_to_pdu(req);

			scsi_req_init(&vbr->sreq);
			}
			#endif

	static const struct blk_mq_ops virtio_mq_ops = {		static const struct blk_mq_ops virtio_mq_ops = {
	.queue_rq = virtio_queue_rq,		.queue_rq = virtio_queue_rq,
	.complete = virtblk_request_done,		.complete = virtblk_request_done,
	.init_request = virtblk_init_request,		.init_request = virtblk_init_request,
			#ifdef CONFIG_VIRTIO_BLK_SCSI
			.initialize_rq_fn = virtblk_initialize_rq,
			#endif
	.map_queues = virtblk_map_queues,		.map_queues = virtblk_map_queues,
	};		};

Admin message