This is a note to let you know that I've just added the patch titled virtio_blk: Fix signedness bug in virtblk_prep_rq() to the 6.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: virtio_blk-fix-signedness-bug-in-virtblk_prep_rq.patch and it can be found in the queue-6.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit cbb2e59e1d2b68825db8b13c94ffd89686df44ec Author: Rafael Mendonca <rafaelmendsr@xxxxxxxxx> Date: Fri Oct 21 17:41:26 2022 -0300 virtio_blk: Fix signedness bug in virtblk_prep_rq() [ Upstream commit a26116c1e74028914f281851488546c91cbae57d ] The virtblk_map_data() function returns negative error codes, however, the 'nents' field of vbr->sg_table is an unsigned int, which causes the error handling not to work correctly. Cc: stable@xxxxxxxxxxxxxxx Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()") Signed-off-by: Rafael Mendonca <rafaelmendsr@xxxxxxxxx> Message-Id: <20221021204126.927603-1-rafaelmendsr@xxxxxxxxx> Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx> Reviewed-by: Stefano Garzarella <sgarzare@xxxxxxxxxx> Reviewed-by: Suwan Kim <suwan.kim027@xxxxxxxxx> Reviewed-by: Stefan Hajnoczi <stefanha@xxxxxxxxxx> Acked-by: Jason Wang <jasowang@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c index 3efe3da5f8c2..a7697027ce43 100644 --- a/drivers/block/virtio_blk.c +++ b/drivers/block/virtio_blk.c @@ -334,14 +334,16 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx, struct virtblk_req *vbr) { blk_status_t status; + int num; status = virtblk_setup_cmd(vblk->vdev, req, vbr); if (unlikely(status)) return status; - vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr); - if (unlikely(vbr->sg_table.nents < 0)) + num = virtblk_map_data(hctx, req, vbr); + if (unlikely(num < 0)) return virtblk_fail_to_queue(req, -ENOMEM); + vbr->sg_table.nents = num; blk_mq_start_request(req);