]> git.itanic.dy.fi Git - linux-stable/commit
virtio: packed: fix unmap leak for indirect desc table
authorXuan Zhuo <xuanzhuo@linux.alibaba.com>
Fri, 23 Feb 2024 07:18:33 +0000 (15:18 +0800)
committerSasha Levin <sashal@kernel.org>
Tue, 26 Mar 2024 22:17:35 +0000 (18:17 -0400)
commit51bacd9d29bf98c3ebc65e4a0477bb86306b4140
tree1ef9a6467bd13301d2483ca89e5c3b65d71ae8cf
parent9df6b5a9801fc17da96f6f245dda45ce13bc2156
virtio: packed: fix unmap leak for indirect desc table

[ Upstream commit d5c0ed17fea60cca9bc3bf1278b49ba79242bbcd ]

When use_dma_api and premapped are true, then the do_unmap is false.

Because the do_unmap is false, vring_unmap_extra_packed is not called by
detach_buf_packed.

  if (unlikely(vq->do_unmap)) {
                curr = id;
                for (i = 0; i < state->num; i++) {
                        vring_unmap_extra_packed(vq,
                                                 &vq->packed.desc_extra[curr]);
                        curr = vq->packed.desc_extra[curr].next;
                }
  }

So the indirect desc table is not unmapped. This causes the unmap leak.

So here, we check vq->use_dma_api instead. Synchronously, dma info is
updated based on use_dma_api judgment

This bug does not occur, because no driver use the premapped with
indirect.

Fixes: b319940f83c2 ("virtio_ring: skip unmap for premapped")
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Message-Id: <20240223071833.26095-1-xuanzhuo@linux.alibaba.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/virtio/virtio_ring.c