Skip to content

Commit

Permalink
vhost/scsi: fix reuse of &vq->iov[out] in response
Browse files Browse the repository at this point in the history
The address of the iovec &vq->iov[out] is not guaranteed to contain the scsi
command's response iovec throughout the lifetime of the command.  Rather, it
is more likely to contain an iovec from an immediately following command
after looping back around to vhost_get_vq_desc().  Pass along the iovec
entirely instead.

Fixes: 79c1414 ("vhost/scsi: Convert completion path to use copy_to_iter")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  • Loading branch information
Benjamin Coddington authored and Michael S. Tsirkin committed Aug 23, 2016
1 parent fa8410b commit a77ec83
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions drivers/vhost/scsi.c
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
struct scatterlist *tvc_prot_sgl;
struct page **tvc_upages;
/* Pointer to response header iovec */
struct iovec *tvc_resp_iov;
struct iovec tvc_resp_iov;
/* Pointer to vhost_scsi for our device */
struct vhost_scsi *tvc_vhost;
/* Pointer to vhost_virtqueue for the cmd */
Expand Down Expand Up @@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
memcpy(v_rsp.sense, cmd->tvc_sense_buf,
se_cmd->scsi_sense_length);

iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov,
iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
cmd->tvc_in_iovs, sizeof(v_rsp));
ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
if (likely(ret == sizeof(v_rsp))) {
Expand Down Expand Up @@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
}
cmd->tvc_vhost = vs;
cmd->tvc_vq = vq;
cmd->tvc_resp_iov = &vq->iov[out];
cmd->tvc_resp_iov = vq->iov[out];
cmd->tvc_in_iovs = in;

pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",
Expand Down

0 comments on commit a77ec83

Please sign in to comment.