From 2fe45ec3bffbd3a26f2ed39f60bab0ca5217d8f6 Mon Sep 17 00:00:00 2001 From: Greg Kurz Date: Thu, 30 Nov 2017 22:39:59 +0100 Subject: vhost: fix error check in vhost_verify_ring_mappings() Since commit f1f9e6c5 "vhost: adapt vhost_verify_ring_mappings() to virtio 1 ring layout", we check the mapping of each part (descriptor table, available ring and used ring) of each virtqueue separately. The checking of a part is done by the vhost_verify_ring_part_mapping() function: it returns either 0 on success or a negative errno if the part cannot be mapped at the same place. Unfortunately, the vhost_verify_ring_mappings() function checks its return value the other way round. It means that we either: - only verify the descriptor table of the first virtqueue, and if it is valid we ignore all the other mappings - or ignore all broken mappings until we reach a valid one ie, we only raise an error if all mappings are broken, and we consider all mappings are valid otherwise (false success), which is obviously wrong. This patch ensures that vhost_verify_ring_mappings() only returns success if ALL mappings are okay. Reported-by: Dr. David Alan Gilbert Signed-off-by: Greg Kurz Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/vhost.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 54041948cf..e4290ce93d 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -493,21 +493,21 @@ static int vhost_verify_ring_mappings(struct vhost_dev *dev, j = 0; r = vhost_verify_ring_part_mapping(dev, vq->desc, vq->desc_phys, vq->desc_size, start_addr, size); - if (!r) { + if (r) { break; } j++; r = vhost_verify_ring_part_mapping(dev, vq->avail, vq->avail_phys, vq->avail_size, start_addr, size); - if (!r) { + if (r) { break; } j++; r = vhost_verify_ring_part_mapping(dev, vq->used, vq->used_phys, vq->used_size, start_addr, size); - if (!r) { + if (r) { break; } } -- cgit v1.2.1