From patchwork Fri Oct 25 18:07:16 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Nicholas A. Bellinger" X-Patchwork-Id: 3097261 Return-Path: X-Original-To: patchwork-kvm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id E0D5EBF924 for ; Fri, 25 Oct 2013 18:25:37 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id F3093202FF for ; Fri, 25 Oct 2013 18:25:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1087420250 for ; Fri, 25 Oct 2013 18:25:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754083Ab3JYSZQ (ORCPT ); Fri, 25 Oct 2013 14:25:16 -0400 Received: from mail.linux-iscsi.org ([67.23.28.174]:53360 "EHLO linux-iscsi.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752727Ab3JYSZP (ORCPT ); Fri, 25 Oct 2013 14:25:15 -0400 Received: from linux-iscsi.org (localhost [127.0.0.1]) by linux-iscsi.org (Postfix) with ESMTP id DEABE22D9C5; Fri, 25 Oct 2013 18:07:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=linux-iscsi.org; s=default.private; t=1382724446; bh=rKI4jBccsYqskj47lT5Iljx4zsZv5tC I3SsPTwbazAs=; h=From:To:Cc:Subject:Date:Message-Id; b=b8R0ENEQcW+U Mqru250YQvzIeA9Uxa0oRT5ZgHtzgm/kHDXwLrpbfHMrD75EObxXmyIUdWbCv3b7iOM tvRrF0NvpW+Ma+mIFjZAwsmwH2o5QxeVJTSMbYAF9euns6o/ce5+1XMrG9ebj26BvNW jlpCZ1srh4/n9NAHwz6sszEr0= From: "Nicholas A. Bellinger" To: target-devel Cc: lf-virt , kvm-devel , linux-scsi , linux-kernel , Stefan Hajnoczi , "Michael S. Tsirkin" , Asias He , Nicholas Bellinger Subject: [PATCH] vhost/scsi: Fix incorrect usage of get_user_pages_fast write parameter Date: Fri, 25 Oct 2013 18:07:16 +0000 Message-Id: <1382724436-28478-1-git-send-email-nab@linux-iscsi.org> X-Mailer: git-send-email 1.7.2.5 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Spam-Status: No, score=-7.2 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Nicholas Bellinger This patch addresses a long-standing bug where the get_user_pages_fast() write parameter used for setting the underlying page table entry permission bits was incorrectly set to write=1 for data_direction=DMA_TO_DEVICE, and passed into get_user_pages_fast() via vhost_scsi_map_iov_to_sgl(). However, this parameter is intended to signal WRITEs to pinned userspace PTEs for the virtio-scsi DMA_FROM_DEVICE -> READ payload case, and *not* for the virtio-scsi DMA_TO_DEVICE -> WRITE payload case. This bug would manifest itself as random process segmentation faults on KVM host after repeated vhost starts + stops and/or with lots of vhost endpoints + LUNs. Cc: Stefan Hajnoczi Cc: Michael S. Tsirkin Cc: Asias He Cc: # 3.6+ Signed-off-by: Nicholas Bellinger Reviewed-by: Asias He Acked-by: Michael S. Tsirkin --- drivers/vhost/scsi.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index ce5221f..e663921 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -1056,7 +1056,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) if (data_direction != DMA_NONE) { ret = vhost_scsi_map_iov_to_sgl(cmd, &vq->iov[data_first], data_num, - data_direction == DMA_TO_DEVICE); + data_direction == DMA_FROM_DEVICE); if (unlikely(ret)) { vq_err(vq, "Failed to map iov to sgl\n"); goto err_free;