thebeanogamer / rpms / qemu-kvm

Forked from rpms/qemu-kvm 6 months ago
Clone

Blame SOURCES/kvm-virtio-iommu-Fix-the-partial-copy-of-probe-request.patch

586cba
From b681247c29b59af40c86f8f0ae5709138ae9bf1a Mon Sep 17 00:00:00 2001
586cba
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
586cba
Date: Thu, 23 Jun 2022 10:31:52 +0800
586cba
Subject: [PATCH 04/17] virtio-iommu: Fix the partial copy of probe request
586cba
586cba
RH-Author: Eric Auger <eric.auger@redhat.com>
586cba
RH-MergeRequest: 105: virtio-iommu: Fix bypass mode for assigned devices
586cba
RH-Commit: [4/5] c402164414a8e69bbb6df20af3c2b6d2589d6f3e (eauger1/centos-qemu-kvm)
586cba
RH-Bugzilla: 2100106
586cba
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
586cba
RH-Acked-by: Peter Xu <peterx@redhat.com>
586cba
RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
586cba
586cba
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2100106
586cba
586cba
The structure of probe request doesn't include the tail, this leads
586cba
to a few field missed to be copied. Currently this isn't an issue as
586cba
those missed field belong to reserved field, just in case reserved
586cba
field will be used in the future.
586cba
586cba
Changed 4th parameter of virtio_iommu_iov_to_req() to receive size
586cba
of device-readable part.
586cba
586cba
Fixes: 1733eebb9e75b ("virtio-iommu: Implement RESV_MEM probe request")
586cba
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
586cba
Message-Id: <20220623023152.3473231-1-zhenzhong.duan@intel.com>
586cba
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
586cba
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
586cba
Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
586cba
Reviewed-by: Eric Auger <eric.auger@redhat.com>
586cba
(cherry picked from commit 45461aace83d961e933b27519b81d17b4c690514)
586cba
Signed-off-by: Eric Auger <eric.auger@redhat.com>
586cba
---
586cba
 hw/virtio/virtio-iommu.c | 8 ++++----
586cba
 1 file changed, 4 insertions(+), 4 deletions(-)
586cba
586cba
diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
586cba
index e970d4d5a6..44a041dec9 100644
586cba
--- a/hw/virtio/virtio-iommu.c
586cba
+++ b/hw/virtio/virtio-iommu.c
586cba
@@ -676,11 +676,10 @@ static int virtio_iommu_probe(VirtIOIOMMU *s,
586cba
 
586cba
 static int virtio_iommu_iov_to_req(struct iovec *iov,
586cba
                                    unsigned int iov_cnt,
586cba
-                                   void *req, size_t req_sz)
586cba
+                                   void *req, size_t payload_sz)
586cba
 {
586cba
-    size_t sz, payload_sz = req_sz - sizeof(struct virtio_iommu_req_tail);
586cba
+    size_t sz = iov_to_buf(iov, iov_cnt, 0, req, payload_sz);
586cba
 
586cba
-    sz = iov_to_buf(iov, iov_cnt, 0, req, payload_sz);
586cba
     if (unlikely(sz != payload_sz)) {
586cba
         return VIRTIO_IOMMU_S_INVAL;
586cba
     }
586cba
@@ -693,7 +692,8 @@ static int virtio_iommu_handle_ ## __req(VirtIOIOMMU *s,                \
586cba
                                          unsigned int iov_cnt)          \
586cba
 {                                                                       \
586cba
     struct virtio_iommu_req_ ## __req req;                              \
586cba
-    int ret = virtio_iommu_iov_to_req(iov, iov_cnt, &req, sizeof(req)); \
586cba
+    int ret = virtio_iommu_iov_to_req(iov, iov_cnt, &req,               \
586cba
+                    sizeof(req) - sizeof(struct virtio_iommu_req_tail));\
586cba
                                                                         \
586cba
     return ret ? ret : virtio_iommu_ ## __req(s, &req;;                 \
586cba
 }
586cba
-- 
586cba
2.31.1
586cba