From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933065AbdHVOtt convert rfc822-to-8bit (ORCPT ); Tue, 22 Aug 2017 10:49:49 -0400 Received: from sender-of-o52.zoho.com ([135.84.80.217]:21451 "EHLO sender-of-o52.zoho.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932523AbdHVOtr (ORCPT ); Tue, 22 Aug 2017 10:49:47 -0400 Message-ID: <1503413377.8694.17.camel@klaipeden.com> Subject: Re: [PATCH] vhost: fix end of range for access_ok From: Koichiro Den To: "Michael S. Tsirkin" , linux-kernel@vger.kernel.org Cc: Jason Wang , kvm@vger.kernel.org, virtualization@lists.linux-foundation.org, netdev@vger.kernel.org, David Miller Date: Tue, 22 Aug 2017 23:49:37 +0900 In-Reply-To: <1503344576-8141-1-git-send-email-mst@redhat.com> References: <1503344576-8141-1-git-send-email-mst@redhat.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.22.6 (3.22.6-2.fc25) Mime-Version: 1.0 Content-Transfer-Encoding: 8BIT X-ZohoMailClient: External Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 2017-08-21 at 22:45 +0300, Michael S. Tsirkin wrote: > During access_ok checks, addr increases as we iterate over the data > structure, thus addr + len - 1 will point beyond the end of region we > are translating.  Harmless since we then verify that the region covers > addr, but let's not waste cpu cycles. > > Reported-by: Koichiro Den > Signed-off-by: Michael S. Tsirkin > --- > > Lightly tested, would appreciate an ack from reporter. > >  drivers/vhost/vhost.c | 4 ++-- >  1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c > index e4613a3..ecd70e4 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -1176,7 +1176,7 @@ static int iotlb_access_ok(struct vhost_virtqueue *vq, >  { >   const struct vhost_umem_node *node; >   struct vhost_umem *umem = vq->iotlb; > - u64 s = 0, size, orig_addr = addr; > + u64 s = 0, size, orig_addr = addr, last = addr + len - 1; >   >   if (vhost_vq_meta_fetch(vq, addr, len, type)) >   return true; > @@ -1184,7 +1184,7 @@ static int iotlb_access_ok(struct vhost_virtqueue *vq, >   while (len > s) { >   node = vhost_umem_interval_tree_iter_first(&umem->umem_tree, >      addr, > -    addr + len - 1); > +    last); >   if (node == NULL || node->start > addr) { >   vhost_iotlb_miss(vq, addr, access); >   return false; Michael, Thank you for this one. Acked-by: Koichiro Den