| commit | d9a5bd9d810fdb2e66fa749b76bd1b8efecd290e | |
| author | Benjamin Coddington <bcodding@redhat.com> | |
| Mon, 6 Jun 2016 22:07:59 +0000 (6 18:07 -0400) | ||
| committer | Sasha Levin <alexander.levin@verizon.com> | |
| Wed, 31 Aug 2016 23:21:09 +0000 (31 19:21 -0400) | ||
| tree | 5912d81eefc7c6c556305c87e47c40cd6a5b0081 | treesnapshot (tar.gz zip) |
| parent | f85090ffc9bf6cb6734f563fb42e878b20314bab | commitdiff |
vhost/scsi: fix reuse of &vq->iov[out] in response
[ Upstream commit a77ec83a57890240c546df00ca5df1cdeedb1cc3 ]
The address of the iovec &vq->iov[out] is not guaranteed to contain the scsi
command's response iovec throughout the lifetime of the command. Rather, it
is more likely to contain an iovec from an immediately following command
after looping back around to vhost_get_vq_desc(). Pass along the iovec
entirely instead.
Fixes: 79c14141a487 ("vhost/scsi: Convert completion path to use copy_to_iter")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
[ Upstream commit a77ec83a57890240c546df00ca5df1cdeedb1cc3 ]
The address of the iovec &vq->iov[out] is not guaranteed to contain the scsi
command's response iovec throughout the lifetime of the command. Rather, it
is more likely to contain an iovec from an immediately following command
after looping back around to vhost_get_vq_desc(). Pass along the iovec
entirely instead.
Fixes: 79c14141a487 ("vhost/scsi: Convert completion path to use copy_to_iter")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
| drivers/vhost/scsi.c | diffblobblamehistory |