Patch "vringh: Use wiov->used to check for read/write desc order" has been added to the 4.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    vringh: Use wiov->used to check for read/write desc order

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     vringh-use-wiov-used-to-check-for-read-write-desc-or.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e755f85097d6d726581a499b4f1f172fefe364ec
Author: Neeraj Upadhyay <neeraju@xxxxxxxxxxxxxx>
Date:   Fri Jun 25 08:55:02 2021 +0530

    vringh: Use wiov->used to check for read/write desc order
    
    [ Upstream commit e74cfa91f42c50f7f649b0eca46aa049754ccdbd ]
    
    As __vringh_iov() traverses a descriptor chain, it populates
    each descriptor entry into either read or write vring iov
    and increments that iov's ->used member. So, as we iterate
    over a descriptor chain, at any point, (riov/wriov)->used
    value gives the number of descriptor enteries available,
    which are to be read or written by the device. As all read
    iovs must precede the write iovs, wiov->used should be zero
    when we are traversing a read descriptor. Current code checks
    for wiov->i, to figure out whether any previous entry in the
    current descriptor chain was a write descriptor. However,
    iov->i is only incremented, when these vring iovs are consumed,
    at a later point, and remain 0 in __vringh_iov(). So, correct
    the check for read and write descriptor order, to use
    wiov->used.
    
    Acked-by: Jason Wang <jasowang@xxxxxxxxxx>
    Reviewed-by: Stefano Garzarella <sgarzare@xxxxxxxxxx>
    Signed-off-by: Neeraj Upadhyay <neeraju@xxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/1624591502-4827-1-git-send-email-neeraju@xxxxxxxxxxxxxx
    Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
index d56736655dec..da47542496cc 100644
--- a/drivers/vhost/vringh.c
+++ b/drivers/vhost/vringh.c
@@ -329,7 +329,7 @@ __vringh_iov(struct vringh *vrh, u16 i,
 			iov = wiov;
 		else {
 			iov = riov;
-			if (unlikely(wiov && wiov->i)) {
+			if (unlikely(wiov && wiov->used)) {
 				vringh_bad("Readable desc %p after writable",
 					   &descs[i]);
 				err = -EINVAL;