2022-10-21 20:48:32

by Rafael Mendonca

[permalink] [raw]
Subject: [PATCH] virtio_blk: Fix signedness bug in virtblk_prep_rq()

The virtblk_map_data() function returns negative error codes, however, the
'nents' field of vbr->sg_table is an unsigned int, which causes the error
handling not to work correctly.

Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
Signed-off-by: Rafael Mendonca <[email protected]>
---
drivers/block/virtio_blk.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 19da5defd734..291f705e61a8 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -321,16 +321,18 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx,
struct virtblk_req *vbr)
{
blk_status_t status;
+ int num;

status = virtblk_setup_cmd(vblk->vdev, req, vbr);
if (unlikely(status))
return status;

- vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr);
- if (unlikely(vbr->sg_table.nents < 0)) {
+ num = virtblk_map_data(hctx, req, vbr);
+ if (unlikely(num < 0)) {
virtblk_cleanup_cmd(req);
return BLK_STS_RESOURCE;
}
+ vbr->sg_table.nents = num;

blk_mq_start_request(req);

--
2.34.1


2022-10-24 17:15:42

by Suwan Kim

[permalink] [raw]
Subject: Re: [PATCH] virtio_blk: Fix signedness bug in virtblk_prep_rq()

On Sat, Oct 22, 2022 at 5:42 AM Rafael Mendonca <[email protected]> wrote:
>
> The virtblk_map_data() function returns negative error codes, however, the
> 'nents' field of vbr->sg_table is an unsigned int, which causes the error
> handling not to work correctly.
>
> Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
> Signed-off-by: Rafael Mendonca <[email protected]>
> ---
> drivers/block/virtio_blk.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index 19da5defd734..291f705e61a8 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -321,16 +321,18 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx,
> struct virtblk_req *vbr)
> {
> blk_status_t status;
> + int num;
>
> status = virtblk_setup_cmd(vblk->vdev, req, vbr);
> if (unlikely(status))
> return status;
>
> - vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr);
> - if (unlikely(vbr->sg_table.nents < 0)) {
> + num = virtblk_map_data(hctx, req, vbr);
> + if (unlikely(num < 0)) {
> virtblk_cleanup_cmd(req);
> return BLK_STS_RESOURCE;
> }
> + vbr->sg_table.nents = num;
>
> blk_mq_start_request(req);
>
> --
> 2.34.1
>

Looks good to me!

Reviewed-by: Suwan Kim <[email protected]>

2022-10-24 21:13:38

by Stefan Hajnoczi

[permalink] [raw]
Subject: Re: [PATCH] virtio_blk: Fix signedness bug in virtblk_prep_rq()

On Fri, Oct 21, 2022 at 05:41:26PM -0300, Rafael Mendonca wrote:
> The virtblk_map_data() function returns negative error codes, however, the
> 'nents' field of vbr->sg_table is an unsigned int, which causes the error
> handling not to work correctly.
>
> Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
> Signed-off-by: Rafael Mendonca <[email protected]>
> ---
> drivers/block/virtio_blk.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)

Reviewed-by: Stefan Hajnoczi <[email protected]>


Attachments:
(No filename) (541.00 B)
signature.asc (499.00 B)
Download all attachments

2022-10-24 21:50:56

by Stefano Garzarella

[permalink] [raw]
Subject: Re: [PATCH] virtio_blk: Fix signedness bug in virtblk_prep_rq()

On Fri, Oct 21, 2022 at 05:41:26PM -0300, Rafael Mendonca wrote:
>The virtblk_map_data() function returns negative error codes, however, the
>'nents' field of vbr->sg_table is an unsigned int, which causes the error
>handling not to work correctly.
>
>Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
>Signed-off-by: Rafael Mendonca <[email protected]>
>---
> drivers/block/virtio_blk.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)

Good catch!

Reviewed-by: Stefano Garzarella <[email protected]>

>
>diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
>index 19da5defd734..291f705e61a8 100644
>--- a/drivers/block/virtio_blk.c
>+++ b/drivers/block/virtio_blk.c
>@@ -321,16 +321,18 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx,
> struct virtblk_req *vbr)
> {
> blk_status_t status;
>+ int num;
>
> status = virtblk_setup_cmd(vblk->vdev, req, vbr);
> if (unlikely(status))
> return status;
>
>- vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr);
>- if (unlikely(vbr->sg_table.nents < 0)) {
>+ num = virtblk_map_data(hctx, req, vbr);
>+ if (unlikely(num < 0)) {
> virtblk_cleanup_cmd(req);
> return BLK_STS_RESOURCE;
> }
>+ vbr->sg_table.nents = num;
>
> blk_mq_start_request(req);
>
>--
>2.34.1
>

2022-11-07 08:10:01

by Jason Wang

[permalink] [raw]
Subject: Re: [PATCH] virtio_blk: Fix signedness bug in virtblk_prep_rq()

On Sat, Oct 22, 2022 at 4:42 AM Rafael Mendonca <[email protected]> wrote:
>
> The virtblk_map_data() function returns negative error codes, however, the
> 'nents' field of vbr->sg_table is an unsigned int, which causes the error
> handling not to work correctly.
>
> Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
> Signed-off-by: Rafael Mendonca <[email protected]>

Acked-by: Jason Wang <[email protected]>

Do we need to cc the stable?

Thanks

> ---
> drivers/block/virtio_blk.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index 19da5defd734..291f705e61a8 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -321,16 +321,18 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx,
> struct virtblk_req *vbr)
> {
> blk_status_t status;
> + int num;
>
> status = virtblk_setup_cmd(vblk->vdev, req, vbr);
> if (unlikely(status))
> return status;
>
> - vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr);
> - if (unlikely(vbr->sg_table.nents < 0)) {
> + num = virtblk_map_data(hctx, req, vbr);
> + if (unlikely(num < 0)) {
> virtblk_cleanup_cmd(req);
> return BLK_STS_RESOURCE;
> }
> + vbr->sg_table.nents = num;
>
> blk_mq_start_request(req);
>
> --
> 2.34.1
>