[PATCH 4.9 20/71] vhost: make sure used idx is seen before log in vhost_add_used_n()

From: Greg Kroah-Hartman
Date: Mon Jan 07 2019 - 08:09:22 EST

4.9-stable review patch. If anyone has any objections, please let me know.


From: Jason Wang <jasowang@xxxxxxxxxx>

[ Upstream commit 841df922417eb82c835e93d4b93eb6a68c99d599 ]

We miss a write barrier that guarantees used idx is updated and seen
before log. This will let userspace sync and copy used ring before
used idx is update. Fix this by adding a barrier before log_write().

Fixes: 8dd014adfea6f ("vhost-net: mergeable buffers support")
Acked-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
drivers/vhost/vhost.c | 2 ++
1 file changed, 2 insertions(+)

--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -2145,6 +2145,8 @@ int vhost_add_used_n(struct vhost_virtqu
return -EFAULT;
if (unlikely(vq->log_used)) {
+ /* Make sure used idx is seen before log. */
+ smp_wmb();
/* Log used index update. */
vq->log_addr + offsetof(struct vring_used, idx),