Commit 69aff030 authored by Michael S. Tsirkin's avatar Michael S. Tsirkin
Browse files

vhost-user: fix misaligned access to payload 



We currently take a pointer to a misaligned field of a packed structure.
clang reports this as a build warning.
A fix is to keep payload in a separate structure, and access is it
from there using a vectored write.

Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 24e34754

hw/virtio/vhost-user.c

+24 −15
Original line number Diff line number Diff line
@@ -652,33 +652,34 @@ static void slave_read(void *opaque) 
{

    struct vhost_dev *dev = opaque;

    struct vhost_user *u = dev->opaque;

    VhostUserMsg msg = { 0, };

    VhostUserHeader hdr = { 0, };

    VhostUserPayload payload = { 0, };

    int size, ret = 0;



    /* Read header */

    size = read(u->slave_fd, &msg, VHOST_USER_HDR_SIZE);

    size = read(u->slave_fd, &hdr, VHOST_USER_HDR_SIZE);

    if (size != VHOST_USER_HDR_SIZE) {

        error_report("Failed to read from slave.");

        goto err;

    }



    if (msg.hdr.size > VHOST_USER_PAYLOAD_SIZE) {

    if (hdr.size > VHOST_USER_PAYLOAD_SIZE) {

        error_report("Failed to read msg header."

                " Size %d exceeds the maximum %zu.", msg.hdr.size,

                " Size %d exceeds the maximum %zu.", hdr.size,

                VHOST_USER_PAYLOAD_SIZE);

        goto err;

    }



    /* Read payload */

    size = read(u->slave_fd, &msg.payload, msg.hdr.size);

    if (size != msg.hdr.size) {

    size = read(u->slave_fd, &payload, hdr.size);

    if (size != hdr.size) {

        error_report("Failed to read payload from slave.");

        goto err;

    }



    switch (msg.hdr.request) {

    switch (hdr.request) {

    case VHOST_USER_SLAVE_IOTLB_MSG:

        ret = vhost_backend_handle_iotlb_msg(dev, &msg.payload.iotlb);

        ret = vhost_backend_handle_iotlb_msg(dev, &payload.iotlb);

        break;

    case VHOST_USER_SLAVE_CONFIG_CHANGE_MSG :

        ret = vhost_user_slave_handle_config_change(dev);
@@ -692,15 +693,23 @@ static void slave_read(void *opaque) 
     * REPLY_ACK feature handling. Other reply types has to be managed

     * directly in their request handlers.

     */

    if (msg.hdr.flags & VHOST_USER_NEED_REPLY_MASK) {

        msg.hdr.flags &= ~VHOST_USER_NEED_REPLY_MASK;

        msg.hdr.flags |= VHOST_USER_REPLY_MASK;

    if (hdr.flags & VHOST_USER_NEED_REPLY_MASK) {

        struct iovec iovec[2];



        msg.payload.u64 = !!ret;

        msg.hdr.size = sizeof(msg.payload.u64);



        size = write(u->slave_fd, &msg, VHOST_USER_HDR_SIZE + msg.hdr.size);

        if (size != VHOST_USER_HDR_SIZE + msg.hdr.size) {

        hdr.flags &= ~VHOST_USER_NEED_REPLY_MASK;

        hdr.flags |= VHOST_USER_REPLY_MASK;



        payload.u64 = !!ret;

        hdr.size = sizeof(payload.u64);



        iovec[0].iov_base = &hdr;

        iovec[0].iov_len = VHOST_USER_HDR_SIZE;

        iovec[1].iov_base = &payload;

        iovec[1].iov_len = hdr.size;



        size = writev(u->slave_fd, iovec, ARRAY_SIZE(iovec));

        if (size != VHOST_USER_HDR_SIZE + hdr.size) {

            error_report("Failed to send msg reply to slave.");

            goto err;

        }