| Message ID | 20181212100819.21295-2-jasowang@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fix various issue of vhost | expand |
On Wed, Dec 12, 2018 at 06:08:16PM +0800, Jason Wang wrote: > We miss a write barrier that guarantees used idx is updated and seen > before log. This will let userspace sync and copy used ring before > used idx is update. Fix this by adding a barrier before log_write(). > > Fixes: 8dd014adfea6f ("vhost-net: mergeable buffers support") > Signed-off-by: Jason Wang <jasowang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> also for 4.20 and seems like a stable candidate. > --- > drivers/vhost/vhost.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c > index 6b98d8e3a5bf..5915f240275a 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -2220,6 +2220,8 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads, > return -EFAULT; > } > if (unlikely(vq->log_used)) { > + /* Make sure used idx is seen before log. */ > + smp_wmb(); > /* Log used index update. */ > log_write(vq->log_base, > vq->log_addr + offsetof(struct vring_used, idx), > -- > 2.17.1
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 6b98d8e3a5bf..5915f240275a 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -2220,6 +2220,8 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads, return -EFAULT; } if (unlikely(vq->log_used)) { + /* Make sure used idx is seen before log. */ + smp_wmb(); /* Log used index update. */ log_write(vq->log_base, vq->log_addr + offsetof(struct vring_used, idx),
We miss a write barrier that guarantees used idx is updated and seen before log. This will let userspace sync and copy used ring before used idx is update. Fix this by adding a barrier before log_write(). Fixes: 8dd014adfea6f ("vhost-net: mergeable buffers support") Signed-off-by: Jason Wang <jasowang@redhat.com> --- drivers/vhost/vhost.c | 2 ++ 1 file changed, 2 insertions(+)