linux-kernel - Re: [PATCH] vdpa_sim_blk: set number of address spaces and virtqueue groups

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 8 Jul 2022 13:21:46 +0200
From:   Eugenio Perez Martin <eperezma@...hat.com>
To:     Stefano Garzarella <sgarzare@...hat.com>
Cc:     virtualization <virtualization@...ts.linux-foundation.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        "Michael S. Tsirkin" <mst@...hat.com>,
        Jason Wang <jasowang@...hat.com>,
        Gautam Dawar <gautam.dawar@...inx.com>
Subject: Re: [PATCH] vdpa_sim_blk: set number of address spaces and virtqueue groups

On Tue, Jun 21, 2022 at 5:17 PM Stefano Garzarella <sgarzare@...hat.com> wrote:
>
> Commit bda324fd037a ("vdpasim: control virtqueue support") added two
> new fields (nas, ngroups) to vdpasim_dev_attr, but we forgot to
> initialize them for vdpa_sim_blk.
>
> When creating a new vdpa_sim_blk device this causes the kernel
> to panic in this way:
>     $ vdpa dev add mgmtdev vdpasim_blk name blk0
>     BUG: kernel NULL pointer dereference, address: 0000000000000030
>     ...
>     RIP: 0010:vhost_iotlb_add_range_ctx+0x41/0x220 [vhost_iotlb]
>     ...
>     Call Trace:
>      <TASK>
>      vhost_iotlb_add_range+0x11/0x800 [vhost_iotlb]
>      vdpasim_map_range+0x91/0xd0 [vdpa_sim]
>      vdpasim_alloc_coherent+0x56/0x90 [vdpa_sim]
>      ...
>
> This happens because vdpasim->iommu[0] is not initialized when
> dev_attr.nas is 0.
>
> Let's fix this issue by initializing both (nas, ngroups) to 1 for
> vdpa_sim_blk.
>
> Fixes: bda324fd037a ("vdpasim: control virtqueue support")
> Cc: gautam.dawar@...inx.com
> Signed-off-by: Stefano Garzarella <sgarzare@...hat.com>

Acked-by: Eugenio Pérez <eperezma@...hat.com>

> ---
>  drivers/vdpa/vdpa_sim/vdpa_sim_blk.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim_blk.c b/drivers/vdpa/vdpa_sim/vdpa_sim_blk.c
> index 42d401d43911..03a28def8eee 100644
> --- a/drivers/vdpa/vdpa_sim/vdpa_sim_blk.c
> +++ b/drivers/vdpa/vdpa_sim/vdpa_sim_blk.c
> @@ -34,7 +34,11 @@
>  #define VDPASIM_BLK_CAPACITY   0x40000
>  #define VDPASIM_BLK_SIZE_MAX   0x1000
>  #define VDPASIM_BLK_SEG_MAX    32
> +
> +/* 1 virtqueue, 1 address space, 1 virtqueue group */
>  #define VDPASIM_BLK_VQ_NUM     1
> +#define VDPASIM_BLK_AS_NUM     1
> +#define VDPASIM_BLK_GROUP_NUM  1
>
>  static char vdpasim_blk_id[VIRTIO_BLK_ID_BYTES] = "vdpa_blk_sim";
>
> @@ -260,6 +264,8 @@ static int vdpasim_blk_dev_add(struct vdpa_mgmt_dev *mdev, const char *name,
>         dev_attr.id = VIRTIO_ID_BLOCK;
>         dev_attr.supported_features = VDPASIM_BLK_FEATURES;
>         dev_attr.nvqs = VDPASIM_BLK_VQ_NUM;
> +       dev_attr.ngroups = VDPASIM_BLK_GROUP_NUM;
> +       dev_attr.nas = VDPASIM_BLK_AS_NUM;
>         dev_attr.config_size = sizeof(struct virtio_blk_config);
>         dev_attr.get_config = vdpasim_blk_get_config;
>         dev_attr.work_fn = vdpasim_blk_work;
> --
> 2.36.1
>