| Message ID | 20221108103437.105327-2-sgarzare@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | vhost: fix ranges when call vhost_iotlb_itree_first() | expand |
On Tue, Nov 8, 2022 at 6:34 PM Stefano Garzarella <sgarzare@redhat.com> wrote: > > vhost_iotlb_itree_first() requires `start` and `last` parameters > to search for a mapping that overlaps the range. > > In iotlb_translate() we cyclically call vhost_iotlb_itree_first(), > incrementing `addr` by the amount already translated, so rightly > we move the `start` parameter passed to vhost_iotlb_itree_first(), > but we should hold the `last` parameter constant. > > Let's fix it by saving the `last` parameter value before incrementing > `addr` in the loop. > > Fixes: 9ad9c49cfe97 ("vringh: IOTLB support") > Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> > --- > drivers/vhost/vringh.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c > index 11f59dd06a74..828c29306565 100644 > --- a/drivers/vhost/vringh.c > +++ b/drivers/vhost/vringh.c > @@ -1102,7 +1102,7 @@ static int iotlb_translate(const struct vringh *vrh, > struct vhost_iotlb_map *map; > struct vhost_iotlb *iotlb = vrh->iotlb; > int ret = 0; > - u64 s = 0; > + u64 s = 0, last = addr + len - 1; > > spin_lock(vrh->iotlb_lock); > > @@ -1114,8 +1114,7 @@ static int iotlb_translate(const struct vringh *vrh, > break; > } > > - map = vhost_iotlb_itree_first(iotlb, addr, > - addr + len - 1); > + map = vhost_iotlb_itree_first(iotlb, addr, last); > if (!map || map->start > addr) { > ret = -EINVAL; > break; > -- > 2.38.1 >
diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 11f59dd06a74..828c29306565 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -1102,7 +1102,7 @@ static int iotlb_translate(const struct vringh *vrh, struct vhost_iotlb_map *map; struct vhost_iotlb *iotlb = vrh->iotlb; int ret = 0; - u64 s = 0; + u64 s = 0, last = addr + len - 1; spin_lock(vrh->iotlb_lock); @@ -1114,8 +1114,7 @@ static int iotlb_translate(const struct vringh *vrh, break; } - map = vhost_iotlb_itree_first(iotlb, addr, - addr + len - 1); + map = vhost_iotlb_itree_first(iotlb, addr, last); if (!map || map->start > addr) { ret = -EINVAL; break;
vhost_iotlb_itree_first() requires `start` and `last` parameters to search for a mapping that overlaps the range. In iotlb_translate() we cyclically call vhost_iotlb_itree_first(), incrementing `addr` by the amount already translated, so rightly we move the `start` parameter passed to vhost_iotlb_itree_first(), but we should hold the `last` parameter constant. Let's fix it by saving the `last` parameter value before incrementing `addr` in the loop. Fixes: 9ad9c49cfe97 ("vringh: IOTLB support") Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> --- drivers/vhost/vringh.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)