tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vhost-scsi: Fix vhost_scsi_send_bad_target()

Browse Source 
[ Upstream commit b182687135474d7ed905a07cc6cb2734b359e13e ]

Although the support of VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 was
signaled by the commit 664ed90e62 ("vhost/scsi: Set
VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits"),
vhost_scsi_send_bad_target() still assumes the response in a single
descriptor.

In addition, although vhost_scsi_send_bad_target() is used by both I/O
queue and control queue, the response header is always
virtio_scsi_cmd_resp. It is required to use virtio_scsi_ctrl_tmf_resp or
virtio_scsi_ctrl_an_resp for control queue.

Fixes: 664ed90e62 ("vhost/scsi: Set VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits")
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Message-Id: <20250403063028.16045-3-dongli.zhang@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dongli Zhang
2025-04-02 23:29:47 -07:00
committed by Greg Kroah-Hartman
parent 461c258ba7
commit 0ac4643bf2
1 changed files with 37 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
drivers/vhost/scsi.c
View File

@@ -947,23 +947,46 @@ vhost_scsi_send_status(struct vhost_scsi *vs, struct vhost_virtqueue *vq,
pr_err("Faulted on virtio_scsi_cmd_resp\n");
}
#define TYPE_IO_CMD 0
#define TYPE_CTRL_TMF 1
#define TYPE_CTRL_AN 2
static void
vhost_scsi_send_bad_target(struct vhost_scsi *vs,
struct vhost_virtqueue *vq,
int head, unsigned out)
struct vhost_scsi_ctx *vc, int type)
{
struct virtio_scsi_cmd_resp __user *resp;
struct virtio_scsi_cmd_resp rsp;
union {
struct virtio_scsi_cmd_resp cmd;
struct virtio_scsi_ctrl_tmf_resp tmf;
struct virtio_scsi_ctrl_an_resp an;
} rsp;
struct iov_iter iov_iter;
size_t rsp_size;
int ret;
memset(&rsp, 0, sizeof(rsp));
rsp.response = VIRTIO_SCSI_S_BAD_TARGET;
resp = vq->iov[out].iov_base;
ret = __copy_to_user(resp, &rsp, sizeof(rsp));
if (!ret)
vhost_add_used_and_signal(&vs->dev, vq, head, 0);
if (type == TYPE_IO_CMD) {
rsp_size = sizeof(struct virtio_scsi_cmd_resp);
rsp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;
} else if (type == TYPE_CTRL_TMF) {
rsp_size = sizeof(struct virtio_scsi_ctrl_tmf_resp);
rsp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
} else {
rsp_size = sizeof(struct virtio_scsi_ctrl_an_resp);
rsp.an.response = VIRTIO_SCSI_S_BAD_TARGET;
}
iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[vc->out], vc->in,
rsp_size);
ret = copy_to_iter(&rsp, rsp_size, &iov_iter);
if (likely(ret == rsp_size))
vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);
else
pr_err("Faulted on virtio_scsi_cmd_resp\n");
pr_err("Faulted on virtio scsi type=%d\n", type);
}
static int
@@ -1277,7 +1300,7 @@ err:
if (ret == -ENXIO)
break;
else if (ret == -EIO)
vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out);
vhost_scsi_send_bad_target(vs, vq, &vc, TYPE_IO_CMD);
else if (ret == -ENOMEM)
vhost_scsi_send_status(vs, vq, vc.head, vc.out,
SAM_STAT_TASK_SET_FULL);
@@ -1510,7 +1533,10 @@ err:
if (ret == -ENXIO)
break;
else if (ret == -EIO)
vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out);
vhost_scsi_send_bad_target(vs, vq, &vc,
v_req.type == VIRTIO_SCSI_T_TMF ?
TYPE_CTRL_TMF :
TYPE_CTRL_AN);
} while (likely(!vhost_exceeds_weight(vq, ++c, 0)));
out:
mutex_unlock(&vq->mutex);