Re: [PATCH] vhost/net: length miscalculation
From: Alex Williamson
Date: Wed Jan 07 2015 - 10:09:16 EST
On Wed, 2015-01-07 at 10:55 +0200, Michael S. Tsirkin wrote:
> commit 8b38694a2dc8b18374310df50174f1e4376d6824
> vhost/net: virtio 1.0 byte swap
> had this chunk:
> - heads[headcount - 1].len += datalen;
> + heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen);
>
> This adds datalen with the wrong sign, causing guest panics.
>
> Fixes: 8b38694a2dc8b18374310df50174f1e4376d6824
> Reported-by: Alex Williamson <alex.williamson@xxxxxxxxxx>
> Suggested-by: Greg Kurz <gkurz@xxxxxxxxxxxxxxxxxx>
> Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
> ---
>
> Alex, could you please confirm this fixes the crash for you?
Confirmed, this works. Thanks,
Alex
> drivers/vhost/net.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index 14419a8..d415d69 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -538,7 +538,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
> ++headcount;
> seg += in;
> }
> - heads[headcount - 1].len = cpu_to_vhost32(vq, len - datalen);
> + heads[headcount - 1].len = cpu_to_vhost32(vq, len + datalen);
> *iovcount = seg;
> if (unlikely(log))
> *log_num = nlogs;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/