Commit 28c36707 authored by Stefano Garzarella's avatar Stefano Garzarella Committed by zhaoxiaoqiang11
Browse files

vhost: fix range used in translate_desc() 

stable inclusion
from stable-v5.10.163
commit b6c74d2376483d556c8156c3aadd550f1f2d4413
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7PJ9N

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b6c74d2376483d556c8156c3aadd550f1f2d4413



----------------------------------------------------

[ Upstream commit 98047313 ]

vhost_iotlb_itree_first() requires `start` and `last` parameters
to search for a mapping that overlaps the range.

In translate_desc() we cyclically call vhost_iotlb_itree_first(),
incrementing `addr` by the amount already translated, so rightly
we move the `start` parameter passed to vhost_iotlb_itree_first(),
but we should hold the `last` parameter constant.

Let's fix it by saving the `last` parameter value before incrementing
`addr` in the loop.

Fixes: a9709d68 ("vhost: convert pre sorted vhost memory array to interval tree")
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarStefano Garzarella <sgarzare@redhat.com>
Message-Id: <20221109102503.18816-3-sgarzare@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarzhaoxiaoqiang11 <zhaoxiaoqiang11@jd.com>
parent b101880b

drivers/vhost/vhost.c

+2 −2
Original line number Diff line number Diff line
@@ -2061,7 +2061,7 @@ static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len, 
	struct vhost_dev *dev = vq->dev;

	struct vhost_iotlb *umem = dev->iotlb ? dev->iotlb : dev->umem;

	struct iovec *_iov;

	u64 s = 0;

	u64 s = 0, last = addr + len - 1;

	int ret = 0;



	while ((u64)len > s) {
@@ -2071,7 +2071,7 @@ static int translate_desc(struct vhost_virtqueue *vq, u64 addr, u32 len, 
			break;

		}



		map = vhost_iotlb_itree_first(umem, addr, addr + len - 1);

		map = vhost_iotlb_itree_first(umem, addr, last);

		if (map == NULL || map->start > addr) {

			if (umem != dev->iotlb) {

				ret = -EFAULT;