access_ok() returns 1 if it's OK otherwise it should return 0.
Signed-off-by: Dan Carpenter erro...@gmail.com
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index c2aa12c..f82fe57 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -371,7 +371,7 @@ static int
I did an audit for potential integer overflows of values which get passed
to access_ok() and here are the results.
Signed-off-by: Dan Carpenter erro...@gmail.com
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index dd3d6f7..c2aa12c 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers
can any of the above two trigger?
It seems easier to check value for sanity at a single place where it's
passed from userspace to kernel.
Gar. Sorry for that. My mistake.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization
for doing
that.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/virtualization
to re-implement the pr_XXX calls with this layer
of indirection which almost looks like I am going down the path of DPRINT
again.
So what is the general consensus. The current way I implemented it seems
to be how other drivers use it to.
The way Joe suggested is best.
regards,
dan carpenter
= device_info.PortNumber; */
host_device_ctx-path = device_info.path_id;
host_device_ctx-target = device_info.target_id;
All the other host_device_ctx variables were renamed to host_device_obj.
regards,
dan carpenter
___
Virtualization mailing list
Out of date.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/virtualization
,
hv_device is unused and we can delete the definition.
There still might be issues with the patch, but at least you would be
talking about the same thing.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
copy_to_user() returns the amount of data remaining to be copied. We
want to return a negative error code here. The upper layers just
call WARN_ON() if we return non-zero so this doesn't change the
behavior. But returning -EFAULT is still cleaner.
Signed-off-by: Dan Carpenter erro...@gmail.com
We should unlock here and also decrement the number of map-users.
Signed-off-by: Dan Carpenter erro...@gmail.com
---
I'm not very familiar with this code. Please review carefully.
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 017ce60..b0f9e8f 100644
--- a/drivers/xen/gntdev.c
b-args[] has MC_ARGS elements, so the comparison here should be
= instead of . Otherwise we read past the end of the array
one space.
Signed-off-by: Dan Carpenter erro...@gmail.com
---
This is a static checker patch and I haven't tested it. Please
review carefully.
diff --git a/arch/x86/xen
On Fri, Jul 15, 2011 at 06:25:55PM -, Michael Witten wrote:
Do not send more than 15 patches at once to the vger
mailing lists!!!
If you're using mutt just type ESC-t ; d to delete the entire
thread. Don't be a whinge bucket.
regards,
dan carpenter
. What prevents that in the new code?
- kfree(device);
-}
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/virtualization
make sense to
name the destination after the starting point.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/virtualization
. Probably target and path should be u32 types?
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/virtualization
On Thu, Aug 25, 2011 at 09:48:36AM -0700, K. Y. Srinivasan wrote:
+ util_drv.driver.name = driver_name;
+
+ return vmbus_child_driver_register(util_drv.driver);
We should free the allocations if vmbus_child_driver_register() fails.
regards,
dan carpenter
The multiplications here can overflow resulting in smaller buffer
sizes than expected. count comes from a copy_from_user().
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 880798a..2f3c363 100644
--- a/drivers/xen/gntdev.c
-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/xen/gntalloc.c b/drivers/xen/gntalloc.c
index f6832f4..23c60cf 100644
--- a/drivers/xen/gntalloc.c
+++ b/drivers/xen/gntalloc.c
@@ -280,7 +280,7 @@ static long gntalloc_ioctl_alloc(struct
gntalloc_file_private_data *priv
gref-gref_id is unsigned so the error handling didn't work.
gnttab_grant_foreign_access() returns an int type, so we can add a
cast here, and it doesn't cause any problems.
gnttab_grant_foreign_access() can return a variety of errors
including -ENOSPC, -ENOSYS and -ENOMEM.
Signed-off-by: Dan
This will deadlock.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index f3d77b3..ba73661 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -352,7 +352,7 @@ static void
We need to unlock here before returning.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index da0b8ac..d217bed 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -1189,6 +1189,7 @@ static int
We do snprintf() from page to a buffer with TCM_VHOST_NAMELEN
characters so the current code will silently truncate the last
character.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index d217bed..57d39c5 100644
There is a memory leak here.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index 57d39c5..29850cb 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -1420,6 +1420,7 @@ static struct se_wwn
strlen() doesn't count the NUL terminator. I missed this one in the
patches I sent yesterday.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index 29850cb..ea72198 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers
Smatch complains about the inconsistent NULL checking here. Fix it to
return NULL on failure.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
---
This is only needed in linux-next.
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 2edfb5c..457db0c 100644
If m.num is too large then the m.num * sizeof(*m.arr) multiplication
could overflow and the access_ok() check wouldn't test the right size.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
---
Only needed in linux-next.
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index
__copy_to_user() returns the number of bytes remaining to be copied but
we want to return a negative error code here.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index fdff8f9..0ce006a 100644
--- a/drivers/xen/privcmd.c
+++ b
When we use this pointer, we cast away the const modifier and modify the
data. I think it was an accident to declare it as const.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/include/xen/privcmd.h b/include/xen/privcmd.h
index a853168..58ed953 100644
--- a/include/xen
long [noderef] [usertype]
asn:1*[addressable] [assigned] user_mfn
drivers/xen/privcmd.c:388:32:got unsigned long [usertype] *noident
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
---
v2: In v1 I removed the const from the declaration but now I just removed it
from the cast. This data
On Mon, Sep 10, 2012 at 11:35:11AM +0100, David Vrabel wrote:
On 08/09/12 10:52, Dan Carpenter wrote:
If m.num is too large then the m.num * sizeof(*m.arr) multiplication
could overflow and the access_ok() check wouldn't test the right size.
m.num is range checked later on so it doesn't
, ubuf, len);
469
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
)
^^
If we hit this condition, we have corrupted some memory.
345 pci_seg_supported = false;
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https
The parenthesis are in the wrong place so the original code is
equivalent to:
if (!xen_feature(XENFEAT_writable_descriptor_tables)) { ...
Which obviously was not intended.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
We recently added locking in fill_balloon() but there was one error path
which was missed.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
---
Only needed in linux-next.
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index f70151b..1c50e98 100644
it will have an easy to debug crash.
811 }
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
,
240 segs_to_unmap);
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
197 end:
198 *mem_device = acpi_driver_data(device);
^^
Dereference.
199 if (!(*mem_device)) {
200 pr_err(PREFIX Driver data not found\n);
regards,
dan carpenter
The parenthesis are in the wrong place so the original code is
equivalent to:
if (!xen_feature(0x1)) { ...
Or:
if (!xen_feature(XENFEAT_writable_descriptor_tables)) { ...
Which obviously was not intended.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
---
I sent this last
debugfs_create_dir() returns ERR_PTR(-ENODEV) if debugfs is disabled.
Also my static checker doesn't like it when we print the error code, but
it's always just NULL.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
On Fri, Jul 19, 2013 at 12:28:41PM +0200, Arnd Bergmann wrote:
On Friday 19 July 2013, Dan Carpenter wrote:
debugfs_create_dir() returns ERR_PTR(-ENODEV) if debugfs is disabled.
Also my static checker doesn't like it when we print the error code, but
it's always just NULL.
Signed-off
. Ok. You're right.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
The PTR_ERR(NULL) here is not useful.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
---
v2: completely different
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 1b456fe..4cf46d8 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char
On Mon, Jul 29, 2013 at 06:12:31AM -0700, Greg Kroah-Hartman wrote:
On Mon, Jul 29, 2013 at 12:41:31PM +0530, Amit Shah wrote:
On (Mon) 22 Jul 2013 [23:41:00], Dan Carpenter wrote:
The PTR_ERR(NULL) here is not useful.
Signed-off-by: Dan Carpenter dan.carpen...@oracle.com
---
v2
and "in"
aren't initialized. We handle that a few lines after the printk. I was
tempted to just delete the pr_debug() but I decided to just initialize
them to zero instead.
Also checkpatch.pl complains if variables are declared as just
"unsigned" without the "int".
Sign
ion.
See slab_out_of_memory().
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
On Tue, Sep 12, 2017 at 03:02:04PM +0100, Emil Velikov wrote:
> That said, I'm not sure how useful the information is - perhaps it's
> better to drop it all together?
Or a WARN_ONCE().
regards,
dan carpenter
___
Virtualization mailin
We accidentally left out this error return so it leads to some use after
free bugs later on.
Fixes: 0a0be13b8fe2 ("vhost_net: batch submitting XDP buffers to underlayer
sockets")
Signed-off-by: Dan Carpenter
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index dd
after all.
>
It doesn't hurt to put things in linux-next for a week and then 5.0 and
-stable. Not a lot of testing happens on linux-next, but some does.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
The first argument to WARN_ONCE() is a condition.
Fixes: 5800dc5c19f3 ("x86/paravirt: Fix spectre-v2 mitigations for paravirt
guests")
Signed-off-by: Dan Carpenter
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index bbf006fe78d7..e4d4df37922a 100644
--- a/arch/
ret = 0;
131
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
Hi Jason,
url:
https://github.com/0day-ci/linux/commits/Jason-Wang/vDPA-support/20200117-170243
base: https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git linux-next
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot
Reported-by: Dan Carpenter
smatch
If "offset" is non-zero then we end up copying from beyond the end of
the config because of pointer math. We can fix this by casting the
struct to a u8 pointer.
Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator")
Signed-off-by: Dan Carpenter
---
Is it really worth le
The "read" and "write" variables need to be signed for the error
handling to work.
Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator")
Signed-off-by: Dan Carpenter
---
drivers/vdpa/vdpa_sim/vdpa_sim.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff
: hppa-linux-gcc (GCC) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot
Reported-by: Dan Carpenter
New smatch warnings:
drivers/vhost/vdpa.c:356 vhost_vdpa_get_backend_features() warn: maybe return
-EFAULT instead of the bytes remaining?
#
https
(GCC) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot
Reported-by: Dan Carpenter
smatch warnings:
drivers/i2c/busses/i2c-virtio.c:160 virtio_i2c_xfer() error: we previously
assumed 'vmsg' could be null (see line 137)
#
https://github.com
On Mon, Sep 14, 2020 at 06:24:55PM +0300, Andy Shevchenko wrote:
> On Mon, Sep 14, 2020 at 05:48:07PM +0300, Dan Carpenter wrote:
> > Hi Jie,
> >
> > url:
> > https://github.com/0day-ci/linux/commits/Jie-Deng/i2c-virtio-add-a-virtio-i2c-frontend-driver/20200911-115
9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot
Reported-by: Dan Carpenter
New smatch warnings:
drivers/vhost/vdpa.c:844 vhost_vdpa_open() error: uninitialized symbol 'r'.
Old smatch warnings:
drivers/vhost/vdpa.c:436
) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot
Reported-by: Dan Carpenter
smatch warnings:
drivers/vhost/scsi.c:606 vhost_scsi_get_cmd() error: uninitialized symbol 'cpu'.
#
https://github.com/0day-ci/linux/commit
(Debian 9.3.0-13) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kbuild test robot
Reported-by: Dan Carpenter
smatch warnings:
drivers/vhost/vdpa.c:348 vhost_vdpa_set_vring_kick() error: uninitialized
symbol 'r'.
#
https://github.com/0day-ci/linux/commit
The copy_to/from_user() functions return the number of bytes which we
weren't able to copy but the ioctl should return -EFAULT if they fail.
Fixes: a127c5bbb6a8 ("vhost-vdpa: fix backend feature ioctls")
Signed-off-by: Dan Carpenter
---
drivers/vhost/vdpa.c | 10 +-
1 file
On Sun, Aug 09, 2020 at 06:34:04AM +, Eli Cohen wrote:
> Acked-by: Eli Cohen
>
> BTW, vdpa_sim has the same bug.
>
I sent a patch for that on April 6.
[PATCH 2/2] vdpa: Fix pointer math bug in vdpasim_get_config()
Jason acked the patch but it wasn't applied.
regards,
d
This should return -ENOMEM if the allocation fails. Currently it
either returns success or an uninitialized value.
Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code")
Signed-off-by: Dan Carpenter
---
drivers/vdpa/mlx5/core/mr.c | 4 +++-
1 file changed, 3 insert
There is a pointer math bug here so if "offset" is non-zero then this
will copy memory from beyond the end of the array.
Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices")
Signed-off-by: Dan Carpenter
---
drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +
le kernels.
> kfree(mem);
> }
> -EXPORT_SYMBOL(kzfree);
> +EXPORT_SYMBOL(kfree_sensitive);
>
> /**
> * ksize - get the actual amount of memory allocated for a given object
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
The drm_gem_shmem_get_pages_sgt() function returns error pointers on
error, it never returns NULL.
Fixes: d323bb44e4d2 ("drm/virtio: Call the right shmem helpers")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/virtio/virtgpu_object.c | 4 ++--
1 file changed, 2 insertions(+), 2
is a stable material. Is there any
> known instance where the memset was optimized out from kzfree?
I told him to add the stable. Otherwise it will just get reported to
me again. It's a just safer to backport it before we forget.
regards,
dan carpenter
_
a "#define kzfree kfree_sensitive" so that things continue to
compile and we can remove it in the next kernel release?
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoun
Smatch complains that "rc" can be uninitialized if we hit the "break;"
statement on the first iteration through the loop. I suspect that this
can't happen in real life, but returning a zero literal is cleaner and
silence the static checker warning.
Signed-off-by: Dan Car
The "vma->vm_pgoff" variable is an unsigned long so if it's larger than
INT_MAX then "index" can be negative leading to an underflow. Fix this
by changing the type of "index" to "unsigned long".
Fixes: ddd89d0a059d ("vhost_vdpa: support doorbell
The copy_to_user() function returns the number of bytes remaining to be
copied but this should return -EFAULT to the user.
Fixes: 1b48dc03e575 ("vhost: vdpa: report iova range")
Signed-off-by: Dan Carpenter
---
drivers/vhost/vdpa.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletio
ing.
>
> FWIW, this series has found at least one bug so far:
> https://lore.kernel.org/lkml/CAFCwf11izHF=g1mGry1fE5kvFFFrxzhPSM6qKAO8gxSp=kr...@mail.gmail.com/
This is a fallthrough to a return and not to a break. That should
trigger a warning. The fallthrough to a break should not generate a
warning.
The bug we're trying to fix is "missing break statement" but if the
result of the bug is "we hit a break statement" then now we're just
talking about style. GCC should limit itself to warning about
potentially buggy code.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
t; case 0:
> ++x;
> default:
> ;
> }
Don't warn for this.
If adding a break statement changes the flow of the code then warn about
potentially missing break statements, but if it doesn't change anything
then don't warn about it.
regards,
dan carpenter
(Debian 9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot
Reported-by: Dan Carpenter
smatch warnings:
drivers/vhost/vsock.c:648 vhost_vsock_dev_open() error: uninitialized symbol
'ret'.
vim +/ret +648 drivers/vhost/vsock.c
433fc58e6bf2c8b
This is freed both here and in the caller (virtio_gpu_vram_map()) so
it's a double free. The correct place is only in the caller.
Fixes: 16845c5d5409 ("drm/virtio: implement blob resources: implement vram
object")
Signed-off-by: Dan Carpenter
---
drivers/gpu/drm/virtio/virtgp
Return -ENOMEM if vp_modern_map_vq_notify() fails. Currently it
returns success.
Fixes: 11d8ffed00b2 ("vp_vdpa: switch to use vp_modern_map_vq_notify()")
Signed-off-by: Dan Carpenter
---
drivers/vdpa/virtio_pci/vp_vdpa.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/dr
ct virtio_blk_config, blk_size,
> >_size);
> > - if (!err)
> > + if (!err && blk_size > 0 && blk_size <= max_size)
>
> The check here is incorrect. I will use PAGE_SIZE as the maximum
> boundary in the new ve
binder_debug(BINDER_DEBUG_TRANSACTION,
> "failed fd fixup txn %d fd %d\n",
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
turn -ENOMEM;
438 }
439
440 pci_set_master(pdev);
441 pci_set_drvdata(pdev, adapter);
442
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfo
indented too far
169 }
170 vp_modern_config_vector(mdev, queues);
171 vp_vdpa->config_irq = irq;
172
173 return 0;
174 err:
175 vp_vdpa_free_irq(vp_vdpa);
176
d) {
1078SetPageDirty(page);
1079/* FIXME: remove after cleanups */
1080ClearPageReserved(page);
1081}
1082}
1083page_offline_end();
1084 }
regards,
This should return -ENOMEM if alloc_workqueue() fails. Currently it
returns success.
Fixes: b66219796563 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Signed-off-by: Dan Carpenter
---
drivers/vdpa/vdpa_user/vduse_dev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletio
The concern here is that "ret" can be uninitialized if we hit the
"goto next" condition on every iteration through the loop.
Fixes: 41ba1b5f9d4b ("vdpa: Support transferring virtual addressing during DMA
mapping")
Signed-off-by: Dan Carpenter
---
drivers/vhost/vd
mplicated but
I'm not sure what. It calls container_of() and that looks buggy until
you spot the BUILD_BUG_ON_ZERO() compile time assert which ensures that
the container_of() is a no-op.
Only one of the callers checks for error pointers correctly so maybe
it's too complicated or maybe there sho
g->iova + msg->size - 1 > v->range.last)
But writing integer overflow check correctly is notoriously difficult.
Do you think you could send a fix for that which is separate from the
patcheset? We'd want to backport it to stable.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
bugfix? Will it have any effect on runtime at all?
To me, hearing your thoughts on this is valuable even if you have to
guess. "I noticed this mistake during review and I don't think it will
affect runtime."
regards,
dan carpenter
___
Virtualizat
549
550 preempt_enable();
551
552 if (poll_rx || sock_has_rx_data(sock))
553 vhost_net_busy_poll_try_queue(net, vq);
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundati
On Wed, Aug 11, 2021 at 08:51:22PM +0800, Jason Wang wrote:
> Hi Dan:
>
> On Wed, Aug 11, 2021 at 8:14 PM Dan Carpenter
> wrote:
> >
> > Hello Jason Wang,
> >
> > The patch 030881372460: "vhost_net: basic polling support" from Mar
> > 4, 20
On Wed, Sep 29, 2021 at 02:37:42PM +0300, Dan Carpenter wrote:
> 89 /* The last byte is the status and we checked if the last iov
> has
> 90 * enough room for it.
> 91 */
> 92 to_push = vringh_kiov_length(>in_iov) - 1;
>
185 return false;
186
187 pushed += bytes;
188
189 /* Make sure data is wrote before advancing index */
190 smp_wmb();
191
192 vringh_complete_iotlb(>vring, vq->head, pushed);
193
194 return true;
195 }
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
On Wed, Sep 29, 2021 at 02:07:12PM +0200, Stefano Garzarella wrote:
> On Wed, Sep 29, 2021 at 02:46:52PM +0300, Dan Carpenter wrote:
> > On Wed, Sep 29, 2021 at 02:37:42PM +0300, Dan Carpenter wrote:
> > > 89 /* The last byte is the status and we checked if the l
d but it will break
at runtime.
For now, it's only vc4_create_object() which is broken.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
On Mon, Dec 06, 2021 at 12:16:24PM +0100, Thomas Zimmermann wrote:
> Hi
>
> Am 06.12.21 um 11:42 schrieb Dan Carpenter:
> > On Tue, Nov 30, 2021 at 10:52:55AM +0100, Thomas Zimmermann wrote:
> > > GEM helper libraries use struct drm_driver.gem_create_object to let
&g
; > assignment.
> > >
> > > Fixes: 33b347503f01 ("vdpa: Define vdpa mgmt device, ops and a netlink
> > > interface")
> > > Reported-by: kernel test robot
> > > Reported-by: Dan Carpenter
> > > Signed-off-by: Parav Pandit
> >
>
The drm_gem_shmem_get_sg_table() function never returns NULL. It returns
error pointers on error.
Fixes: c66df701e783 ("drm/virtio: switch from ttm to gem shmem helpers")
Signed-off-by: Dan Carpenter
---
v2: I originally sent this patch on 19 Jun 2020 but it was somehow
not appl
h positive u32 value and basically any "c->len" is
accepted.
Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend")
Reported-by: Xie Yongji
Signed-off-by: Dan Carpenter
---
v4: split into a separate patch
drivers/vhost/vdpa.c | 2 +-
1 file changed, 1 insertion
; subtraction
results in a very high u32 value. The out of bounds offset can result
in memory corruption.
Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Signed-off-by: Dan Carpenter
---
v2: fix reversed if statement
v3: fix vhost_vdpa_c
6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Signed-off-by: Dan Carpenter
---
drivers/vdpa/vdpa_user/vduse_dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c
b/drivers/vdpa/vdpa_user/vduse_dev.c
index c9204c62f339..
deally if this could be fixed in a central way, but if not
then hopefully I've added the relevant lists to the CC.
regards,
dan carpenter
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
the drivers. But somehow the vc4 chunk from your
patch was dropped. It was *NOT* dropped by Stephen Rothwell. It got
dropped earlier. I am including the `git format-patch -1 ` output
from the commit.
regards,
dan carpenter
>From 4ff22f487f8c26b99cbe1678344595734c001a39 Mon Sep 17 00:00:00 2
; subtraction
results in a very high u32 value.
Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Signed-off-by: Dan Carpenter
---
drivers/vdpa/vdpa_user/vduse_dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/vdpa/vdpa_user
1 - 100 of 162 matches
Mail list logo
