From patchwork Mon Oct 30 21:40:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefano Stabellini X-Patchwork-Id: 10033291 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id EC5E4600C5 for ; Mon, 30 Oct 2017 21:42:42 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DCE59288A1 for ; Mon, 30 Oct 2017 21:42:42 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D1A7928982; Mon, 30 Oct 2017 21:42:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 76D82288A1 for ; Mon, 30 Oct 2017 21:42:42 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e9Hn8-0000Yi-Ut; Mon, 30 Oct 2017 21:40:18 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e9Hn7-0000YM-NW for xen-devel@lists.xen.org; Mon, 30 Oct 2017 21:40:17 +0000 Received: from [85.158.137.68] by server-5.bemta-3.messagelabs.com id 04/11-20834-04C97F95; Mon, 30 Oct 2017 21:40:16 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrDLMWRWlGSWpSXmKPExsVybKJssq79nO+ RBkffclos+biYxYHR4+ju30wBjFGsmXlJ+RUJrBldkz+wF9wRrtjxSq6B8TN/FyMXh5DAOiaJ Vb8uMXUxcnKwCDhITNvawtjFyMHBKBAj8eCHNUiYUSBMYvLlJawgNpuAocTfJ5vYQGwRATmJp rfvWEBsZoFqiTW9bxhBbGEBd4k/a26zQIxUlTjW/hRsPK+Am8SqFwuYQWwJoN6TxyazTmDkXs DIsIpRozi1qCy1SNfQWC+pKDM9oyQ3MTNH19DAWC83tbg4MT01JzGpWC85P3cTI9C3DECwg3H bds9DjJIcTEqivDsdv0cK8SXlp1RmJBZnxBeV5qQWH2KU4eBQkuC9NQsoJ1iUmp5akZaZAwwy mLQEB4+SCO8PkDRvcUFibnFmOkTqFKMlx7FNl/8wcXTcvAskn8183cAsxJKXn5cqJc77E6RBA KQhozQPbhwsEi4xykoJ8zICHSjEU5BalJtZgir/ilGcg1FJmLd2NtAUnsy8Eritr4AOYgI6SE PyC8hBJYkIKakGxmTbiNbKxbkZO4Unfn2mJjyXn/lKunpz0L0oO/lLXye4bxQ22GEs43Pbw3d W2/8Eh/jJ/+6fkE0sSd671yiSYcEt0xkzZzZdWnw9YF21q3rV3vc8N2Yv75uYOKPdkIWt+GzS ifuWVwt/z/TmSPk/Jyx0x8QFju9f6hpsD/+oosq66fIKyRcRS5VYijMSDbWYi4oTAcFBjtF/A gAA X-Env-Sender: sstabellini@kernel.org X-Msg-Ref: server-4.tower-31.messagelabs.com!1509399613!54589958!1 X-Originating-IP: [198.145.29.99] X-SpamReason: No, hits=0.0 required=7.0 tests= X-StarScan-Received: X-StarScan-Version: 9.4.45; banners=-,-,- X-VirusChecked: Checked Received: (qmail 39860 invoked from network); 30 Oct 2017 21:40:15 -0000 Received: from mail.kernel.org (HELO mail.kernel.org) (198.145.29.99) by server-4.tower-31.messagelabs.com with DHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 30 Oct 2017 21:40:15 -0000 Received: from localhost.localdomain (162-198-228-33.lightspeed.wlfrct.sbcglobal.net [162.198.228.33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E6E0521923; Mon, 30 Oct 2017 21:40:12 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E6E0521923 From: Stefano Stabellini To: boris.ostrovsky@oracle.com Date: Mon, 30 Oct 2017 14:40:10 -0700 Message-Id: <1509399611-12503-1-git-send-email-sstabellini@kernel.org> X-Mailer: git-send-email 1.9.1 Cc: jgross@suse.com, stefano@aporeto.com, sstabellini@kernel.org, linux-kernel@vger.kernel.org, xen-devel@lists.xen.org Subject: [Xen-devel] [PATCH 1/2] pvcalls: check return value from copy_from/to_iter X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP Check the return value of copy_from_iter in __write_ring and copy_to_iter in __read_ring. Update "len" accordingly. In the cases where we issue two consecutive copy_from_iter, or two consecutive copy_to_iter, first check return, then goto out if it is not what we expect. Signed-off-by: Stefano Stabellini --- drivers/xen/pvcalls-front.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c index 8e7426083..f2dcac88 100644 --- a/drivers/xen/pvcalls-front.c +++ b/drivers/xen/pvcalls-front.c @@ -456,18 +456,21 @@ static int __write_ring(struct pvcalls_data_intf *intf, masked_cons = pvcalls_mask(cons, array_size); if (masked_prod < masked_cons) { - copy_from_iter(data->out + masked_prod, len, msg_iter); + len = copy_from_iter(data->out + masked_prod, len, msg_iter); } else { if (len > array_size - masked_prod) { - copy_from_iter(data->out + masked_prod, + int ret = copy_from_iter(data->out + masked_prod, array_size - masked_prod, msg_iter); - copy_from_iter(data->out, - len - (array_size - masked_prod), - msg_iter); + if (ret != array_size - masked_prod) { + len = ret; + goto out; + } + len = ret + copy_from_iter(data->out, len - ret, msg_iter); } else { - copy_from_iter(data->out + masked_prod, len, msg_iter); + len = copy_from_iter(data->out + masked_prod, len, msg_iter); } } +out: /* write to ring before updating pointer */ virt_wmb(); intf->out_prod += len; @@ -557,18 +560,21 @@ static int __read_ring(struct pvcalls_data_intf *intf, len = size; if (masked_prod > masked_cons) { - copy_to_iter(data->in + masked_cons, len, msg_iter); + len = copy_to_iter(data->in + masked_cons, len, msg_iter); } else { if (len > (array_size - masked_cons)) { - copy_to_iter(data->in + masked_cons, + int ret = copy_to_iter(data->in + masked_cons, array_size - masked_cons, msg_iter); - copy_to_iter(data->in, - len - (array_size - masked_cons), - msg_iter); + if (ret != array_size - masked_cons) { + len = ret; + goto out; + } + len = ret + copy_to_iter(data->in, len - ret, msg_iter); } else { - copy_to_iter(data->in + masked_cons, len, msg_iter); + len = copy_to_iter(data->in + masked_cons, len, msg_iter); } } +out: /* read data from the ring before increasing the index */ virt_mb(); if (!(flags & MSG_PEEK))