From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753211AbdJ3VkO (ORCPT ); Mon, 30 Oct 2017 17:40:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:34488 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751615AbdJ3VkN (ORCPT ); Mon, 30 Oct 2017 17:40:13 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E6E0521923 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=sstabellini@kernel.org From: Stefano Stabellini To: boris.ostrovsky@oracle.com Cc: sstabellini@kernel.org, xen-devel@lists.xen.org, linux-kernel@vger.kernel.org, jgross@suse.com, stefano@aporeto.com Subject: [PATCH 1/2] pvcalls: check return value from copy_from/to_iter Date: Mon, 30 Oct 2017 14:40:10 -0700 Message-Id: <1509399611-12503-1-git-send-email-sstabellini@kernel.org> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Check the return value of copy_from_iter in __write_ring and copy_to_iter in __read_ring. Update "len" accordingly. In the cases where we issue two consecutive copy_from_iter, or two consecutive copy_to_iter, first check return, then goto out if it is not what we expect. Signed-off-by: Stefano Stabellini --- drivers/xen/pvcalls-front.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c index 8e7426083..f2dcac88 100644 --- a/drivers/xen/pvcalls-front.c +++ b/drivers/xen/pvcalls-front.c @@ -456,18 +456,21 @@ static int __write_ring(struct pvcalls_data_intf *intf, masked_cons = pvcalls_mask(cons, array_size); if (masked_prod < masked_cons) { - copy_from_iter(data->out + masked_prod, len, msg_iter); + len = copy_from_iter(data->out + masked_prod, len, msg_iter); } else { if (len > array_size - masked_prod) { - copy_from_iter(data->out + masked_prod, + int ret = copy_from_iter(data->out + masked_prod, array_size - masked_prod, msg_iter); - copy_from_iter(data->out, - len - (array_size - masked_prod), - msg_iter); + if (ret != array_size - masked_prod) { + len = ret; + goto out; + } + len = ret + copy_from_iter(data->out, len - ret, msg_iter); } else { - copy_from_iter(data->out + masked_prod, len, msg_iter); + len = copy_from_iter(data->out + masked_prod, len, msg_iter); } } +out: /* write to ring before updating pointer */ virt_wmb(); intf->out_prod += len; @@ -557,18 +560,21 @@ static int __read_ring(struct pvcalls_data_intf *intf, len = size; if (masked_prod > masked_cons) { - copy_to_iter(data->in + masked_cons, len, msg_iter); + len = copy_to_iter(data->in + masked_cons, len, msg_iter); } else { if (len > (array_size - masked_cons)) { - copy_to_iter(data->in + masked_cons, + int ret = copy_to_iter(data->in + masked_cons, array_size - masked_cons, msg_iter); - copy_to_iter(data->in, - len - (array_size - masked_cons), - msg_iter); + if (ret != array_size - masked_cons) { + len = ret; + goto out; + } + len = ret + copy_to_iter(data->in, len - ret, msg_iter); } else { - copy_to_iter(data->in + masked_cons, len, msg_iter); + len = copy_to_iter(data->in + masked_cons, len, msg_iter); } } +out: /* read data from the ring before increasing the index */ virt_mb(); if (!(flags & MSG_PEEK)) -- 1.9.1