From patchwork Sun Sep 24 22:36:33 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Al Viro X-Patchwork-Id: 9968883 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 529DA602B9 for ; Sun, 24 Sep 2017 22:37:19 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 345922656B for ; Sun, 24 Sep 2017 22:37:19 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 18A8A27D4A; Sun, 24 Sep 2017 22:37:19 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7A6392656B for ; Sun, 24 Sep 2017 22:37:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753443AbdIXWgf (ORCPT ); Sun, 24 Sep 2017 18:36:35 -0400 Received: from zeniv.linux.org.uk ([195.92.253.2]:48108 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753122AbdIXWgf (ORCPT ); Sun, 24 Sep 2017 18:36:35 -0400 Received: from viro by ZenIV.linux.org.uk with local (Exim 4.87 #1 (Red Hat Linux)) id 1dwFVp-0001AN-Lf; Sun, 24 Sep 2017 22:36:33 +0000 Date: Sun, 24 Sep 2017 23:36:33 +0100 From: Al Viro To: "Michael S. Tsirkin" Cc: linux-scsi@vger.kernel.org Subject: [RFC] apparently broken error recovery in vhost_scsi_iov_to_sgl() Message-ID: <20170924223633.GV32076@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.8.3 (2017-05-23) Sender: linux-scsi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Suppose vhost_scsi_iov_to_sgl() got a two-iovec array, mapped e.g. 20 pages from the first one just fine and failed on the second. static int vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write, struct iov_iter *iter, struct scatterlist *sg, int sg_count) { size_t off = iter->iov_offset; int i, ret; for (i = 0; i < iter->nr_segs; i++) { void __user *base = iter->iov[i].iov_base + off; size_t len = iter->iov[i].iov_len - off; ret = vhost_scsi_map_to_sgl(cmd, base, len, sg, write); if (ret < 0) { for (i = 0; i < sg_count; i++) { struct page *page = sg_page(&sg[i]); if (page) put_page(page); } return ret; } sg += ret; off = 0; } return 0; } What are we trying to drop in the if (ret < 0) in there? In the case above we step into it on the second pass through the loop. The first 20 entries of sg had been filled... and sg had been increased by 20, so whatever we find and feed to put_page(), it won't be those 20 pages. Moreover, the caller will reset cmd->tvc_{prot_,}sgl_count to zero, so vhost_scsi_release_cmd() won't find them either. Am I missing something subtle here, or should that thing be doing something like diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 046f6d280af5..e47c5bc3ddca 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -688,6 +688,7 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write, struct scatterlist *sg, int sg_count) { size_t off = iter->iov_offset; + struct scatterlist *p = sg; int i, ret; for (i = 0; i < iter->nr_segs; i++) { @@ -696,8 +697,8 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write, ret = vhost_scsi_map_to_sgl(cmd, base, len, sg, write); if (ret < 0) { - for (i = 0; i < sg_count; i++) { - struct page *page = sg_page(&sg[i]); + while (p < sg) { + struct page *page = sg_page(p++); if (page) put_page(page); }