Commit 5472f14a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost 

Pull virtio fixes from Michael Tsirkin:
 "Misc virtio and vdpa bugfixes"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  vdpa: Consider device id larger than 31
  virtio/vsock: fix the transport to work with VMADDR_CID_ANY
  virtio_ring: Fix querying of maximum DMA mapping size for virtio device
  virtio: always enter drivers/virtio/
  vduse: check that offset is within bounds in get_config()
  vdpa: check that offsets are within bounds
  vduse: fix memory corruption in vduse_dev_ioctl()
parents aa50faff bb47620b

drivers/Makefile

+1 −2
Original line number Original line Diff line number Diff line
@@ -41,8 +41,7 @@ obj-$(CONFIG_DMADEVICES) += dma/ 
# SOC specific infrastructure drivers.

# SOC specific infrastructure drivers.

obj-y				+= soc/

obj-y				+= soc/





obj-$(CONFIG_VIRTIO)		+= virtio/

obj-y				+= virtio/

obj-$(CONFIG_VIRTIO_PCI_LIB)	+= virtio/

obj-$(CONFIG_VDPA)		+= vdpa/

obj-$(CONFIG_VDPA)		+= vdpa/

obj-$(CONFIG_XEN)		+= xen/

obj-$(CONFIG_XEN)		+= xen/

drivers/vdpa/vdpa.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -404,7 +404,8 @@ static int vdpa_mgmtdev_fill(const struct vdpa_mgmt_dev *mdev, struct sk_buff *m 
		goto msg_err;

		goto msg_err;





	while (mdev->id_table[i].device) {

	while (mdev->id_table[i].device) {

		supported_classes |= BIT(mdev->id_table[i].device);

		if (mdev->id_table[i].device <= 63)

			supported_classes |= BIT_ULL(mdev->id_table[i].device);

		i++;

		i++;

	}

	}

drivers/vdpa/vdpa_user/vduse_dev.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -655,7 +655,8 @@ static void vduse_vdpa_get_config(struct vdpa_device *vdpa, unsigned int offset, 
{

{

	struct vduse_dev *dev = vdpa_to_vduse(vdpa);

	struct vduse_dev *dev = vdpa_to_vduse(vdpa);





	if (len > dev->config_size - offset)

	if (offset > dev->config_size ||

	    len > dev->config_size - offset)

		return;

		return;





	memcpy(buf, dev->config + offset, len);

	memcpy(buf, dev->config + offset, len);
@@ -975,7 +976,8 @@ static long vduse_dev_ioctl(struct file *file, unsigned int cmd, 
			break;

			break;





		ret = -EINVAL;

		ret = -EINVAL;

		if (config.length == 0 ||

		if (config.offset > dev->config_size ||

		    config.length == 0 ||

		    config.length > dev->config_size - config.offset)

		    config.length > dev->config_size - config.offset)

			break;

			break;

drivers/vhost/vdpa.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -197,7 +197,7 @@ static int vhost_vdpa_config_validate(struct vhost_vdpa *v, 
	struct vdpa_device *vdpa = v->vdpa;

	struct vdpa_device *vdpa = v->vdpa;

	long size = vdpa->config->get_config_size(vdpa);

	long size = vdpa->config->get_config_size(vdpa);





	if (c->len == 0)

	if (c->len == 0 || c->off > size)

		return -EINVAL;

		return -EINVAL;





	if (c->len > size - c->off)

	if (c->len > size - c->off)

drivers/virtio/virtio_ring.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -268,7 +268,7 @@ size_t virtio_max_dma_size(struct virtio_device *vdev) 
	size_t max_segment_size = SIZE_MAX;

	size_t max_segment_size = SIZE_MAX;





	if (vring_use_dma_api(vdev))

	if (vring_use_dma_api(vdev))

		max_segment_size = dma_max_mapping_size(&vdev->dev);

		max_segment_size = dma_max_mapping_size(vdev->dev.parent);





	return max_segment_size;

	return max_segment_size;

}

}