Commit b1826871 authored by Dongli Zhang's avatar Dongli Zhang Committed by Michael S. Tsirkin
Browse files

vhost-scsi: Fix vhost_scsi_send_bad_target() 



Although the support of VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 was
signaled by the commit 664ed90e ("vhost/scsi: Set
VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits"),
vhost_scsi_send_bad_target() still assumes the response in a single
descriptor.

In addition, although vhost_scsi_send_bad_target() is used by both I/O
queue and control queue, the response header is always
virtio_scsi_cmd_resp. It is required to use virtio_scsi_ctrl_tmf_resp or
virtio_scsi_ctrl_an_resp for control queue.

Fixes: 664ed90e ("vhost/scsi: Set VIRTIO_F_ANY_LAYOUT + VIRTIO_F_VERSION_1 feature bits")
Signed-off-by: default avatarDongli Zhang <dongli.zhang@oracle.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Reviewed-by: default avatarMike Christie <michael.christie@oracle.com>
Message-Id: <20250403063028.16045-3-dongli.zhang@oracle.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent f591cf9f

drivers/vhost/scsi.c

+37 −11
Original line number Diff line number Diff line
@@ -1015,23 +1015,46 @@ vhost_scsi_send_status(struct vhost_scsi *vs, struct vhost_virtqueue *vq, 
		pr_err("Faulted on virtio_scsi_cmd_resp\n");

}



#define TYPE_IO_CMD    0

#define TYPE_CTRL_TMF  1

#define TYPE_CTRL_AN   2



static void

vhost_scsi_send_bad_target(struct vhost_scsi *vs,

			   struct vhost_virtqueue *vq,

			   int head, unsigned out)

			   struct vhost_scsi_ctx *vc, int type)

{

	struct virtio_scsi_cmd_resp __user *resp;

	struct virtio_scsi_cmd_resp rsp;

	union {

		struct virtio_scsi_cmd_resp cmd;

		struct virtio_scsi_ctrl_tmf_resp tmf;

		struct virtio_scsi_ctrl_an_resp an;

	} rsp;

	struct iov_iter iov_iter;

	size_t rsp_size;

	int ret;



	memset(&rsp, 0, sizeof(rsp));

	rsp.response = VIRTIO_SCSI_S_BAD_TARGET;

	resp = vq->iov[out].iov_base;

	ret = __copy_to_user(resp, &rsp, sizeof(rsp));

	if (!ret)

		vhost_add_used_and_signal(&vs->dev, vq, head, 0);



	if (type == TYPE_IO_CMD) {

		rsp_size = sizeof(struct virtio_scsi_cmd_resp);

		rsp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET;

	} else if (type == TYPE_CTRL_TMF) {

		rsp_size = sizeof(struct virtio_scsi_ctrl_tmf_resp);

		rsp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;

	} else {

		rsp_size = sizeof(struct virtio_scsi_ctrl_an_resp);

		rsp.an.response = VIRTIO_SCSI_S_BAD_TARGET;

	}



	iov_iter_init(&iov_iter, ITER_DEST, &vq->iov[vc->out], vc->in,

		      rsp_size);



	ret = copy_to_iter(&rsp, rsp_size, &iov_iter);



	if (likely(ret == rsp_size))

		vhost_add_used_and_signal(&vs->dev, vq, vc->head, 0);

	else

		pr_err("Faulted on virtio_scsi_cmd_resp\n");

		pr_err("Faulted on virtio scsi type=%d\n", type);

}



static int
@@ -1395,7 +1418,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) 
		if (ret == -ENXIO)

			break;

		else if (ret == -EIO)

			vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out);

			vhost_scsi_send_bad_target(vs, vq, &vc, TYPE_IO_CMD);

		else if (ret == -ENOMEM)

			vhost_scsi_send_status(vs, vq, vc.head, vc.out,

					       SAM_STAT_TASK_SET_FULL);
@@ -1631,7 +1654,10 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) 
		if (ret == -ENXIO)

			break;

		else if (ret == -EIO)

			vhost_scsi_send_bad_target(vs, vq, vc.head, vc.out);

			vhost_scsi_send_bad_target(vs, vq, &vc,

						   v_req.type == VIRTIO_SCSI_T_TMF ?

						   TYPE_CTRL_TMF :

						   TYPE_CTRL_AN);

	} while (likely(!vhost_exceeds_weight(vq, ++c, 0)));

out:

	mutex_unlock(&vq->mutex);