diff mbox series

virtio_blk: Fix signedness bug in virtblk_prep_rq()

Message ID 20221021204126.927603-1-rafaelmendsr@gmail.com
State New
Headers
Series virtio_blk: Fix signedness bug in virtblk_prep_rq() |

Commit Message

Rafael Mendonca Oct. 21, 2022, 8:41 p.m. UTC 
  The virtblk_map_data() function returns negative error codes, however, the
'nents' field of vbr->sg_table is an unsigned int, which causes the error
handling not to work correctly.

Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
Signed-off-by: Rafael Mendonca <rafaelmendsr@gmail.com>
---
 drivers/block/virtio_blk.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Stefano Garzarella Oct. 24, 2022, 1:33 p.m. UTC | #1 
On Fri, Oct 21, 2022 at 05:41:26PM -0300, Rafael Mendonca wrote:
>The virtblk_map_data() function returns negative error codes, however, the
>'nents' field of vbr->sg_table is an unsigned int, which causes the error
>handling not to work correctly.
>
>Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
>Signed-off-by: Rafael Mendonca <rafaelmendsr@gmail.com>
>---
> drivers/block/virtio_blk.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)

Good catch!

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

>
>diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
>index 19da5defd734..291f705e61a8 100644
>--- a/drivers/block/virtio_blk.c
>+++ b/drivers/block/virtio_blk.c
>@@ -321,16 +321,18 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx,
> 					struct virtblk_req *vbr)
> {
> 	blk_status_t status;
>+	int num;
>
> 	status = virtblk_setup_cmd(vblk->vdev, req, vbr);
> 	if (unlikely(status))
> 		return status;
>
>-	vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr);
>-	if (unlikely(vbr->sg_table.nents < 0)) {
>+	num = virtblk_map_data(hctx, req, vbr);
>+	if (unlikely(num < 0)) {
> 		virtblk_cleanup_cmd(req);
> 		return BLK_STS_RESOURCE;
> 	}
>+	vbr->sg_table.nents = num;
>
> 	blk_mq_start_request(req);
>
>-- 
>2.34.1
>
Suwan Kim Oct. 24, 2022, 2:46 p.m. UTC | #2 
On Sat, Oct 22, 2022 at 5:42 AM Rafael Mendonca <rafaelmendsr@gmail.com> wrote:
>
> The virtblk_map_data() function returns negative error codes, however, the
> 'nents' field of vbr->sg_table is an unsigned int, which causes the error
> handling not to work correctly.
>
> Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
> Signed-off-by: Rafael Mendonca <rafaelmendsr@gmail.com>
> ---
>  drivers/block/virtio_blk.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index 19da5defd734..291f705e61a8 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -321,16 +321,18 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx,
>                                         struct virtblk_req *vbr)
>  {
>         blk_status_t status;
> +       int num;
>
>         status = virtblk_setup_cmd(vblk->vdev, req, vbr);
>         if (unlikely(status))
>                 return status;
>
> -       vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr);
> -       if (unlikely(vbr->sg_table.nents < 0)) {
> +       num = virtblk_map_data(hctx, req, vbr);
> +       if (unlikely(num < 0)) {
>                 virtblk_cleanup_cmd(req);
>                 return BLK_STS_RESOURCE;
>         }
> +       vbr->sg_table.nents = num;
>
>         blk_mq_start_request(req);
>
> --
> 2.34.1
>

Looks good to me!

Reviewed-by: Suwan Kim <suwan.kim027@gmail.com>
Stefan Hajnoczi Oct. 24, 2022, 3:44 p.m. UTC | #3 
On Fri, Oct 21, 2022 at 05:41:26PM -0300, Rafael Mendonca wrote:
> The virtblk_map_data() function returns negative error codes, however, the
> 'nents' field of vbr->sg_table is an unsigned int, which causes the error
> handling not to work correctly.
> 
> Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
> Signed-off-by: Rafael Mendonca <rafaelmendsr@gmail.com>
> ---
>  drivers/block/virtio_blk.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Jason Wang Nov. 7, 2022, 7:44 a.m. UTC | #4 
On Sat, Oct 22, 2022 at 4:42 AM Rafael Mendonca <rafaelmendsr@gmail.com> wrote:
>
> The virtblk_map_data() function returns negative error codes, however, the
> 'nents' field of vbr->sg_table is an unsigned int, which causes the error
> handling not to work correctly.
>
> Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()")
> Signed-off-by: Rafael Mendonca <rafaelmendsr@gmail.com>

Acked-by: Jason Wang <jasowang@redhat.com>

Do we need to cc the stable?

Thanks

> ---
>  drivers/block/virtio_blk.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index 19da5defd734..291f705e61a8 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -321,16 +321,18 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx,
>                                         struct virtblk_req *vbr)
>  {
>         blk_status_t status;
> +       int num;
>
>         status = virtblk_setup_cmd(vblk->vdev, req, vbr);
>         if (unlikely(status))
>                 return status;
>
> -       vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr);
> -       if (unlikely(vbr->sg_table.nents < 0)) {
> +       num = virtblk_map_data(hctx, req, vbr);
> +       if (unlikely(num < 0)) {
>                 virtblk_cleanup_cmd(req);
>                 return BLK_STS_RESOURCE;
>         }
> +       vbr->sg_table.nents = num;
>
>         blk_mq_start_request(req);
>
> --
> 2.34.1
>
diff mbox series

Patch

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 19da5defd734..291f705e61a8 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -321,16 +321,18 @@  static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx,
 					struct virtblk_req *vbr)
 {
 	blk_status_t status;
+	int num;
 
 	status = virtblk_setup_cmd(vblk->vdev, req, vbr);
 	if (unlikely(status))
 		return status;
 
-	vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr);
-	if (unlikely(vbr->sg_table.nents < 0)) {
+	num = virtblk_map_data(hctx, req, vbr);
+	if (unlikely(num < 0)) {
 		virtblk_cleanup_cmd(req);
 		return BLK_STS_RESOURCE;
 	}
+	vbr->sg_table.nents = num;
 
 	blk_mq_start_request(req);