diff options
| author | Michael S. Tsirkin <mst@redhat.com> | 2012-08-19 00:44:09 +0200 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2012-08-20 23:52:11 +0200 |
| commit | 6de7145ca3db231a84b7516a6cb25878da6ebb19 (patch) | |
| tree | 3958d4cf730acc08fb9f9f1ad3be4cb132eca17e /drivers/vhost | |
| parent | target: Fix regression bug with handling of zero-length data CDBs (diff) | |
| download | linux-6de7145ca3db231a84b7516a6cb25878da6ebb19.tar.xz linux-6de7145ca3db231a84b7516a6cb25878da6ebb19.zip | |
tcm_vhost: Fix vhost_scsi_target structure alignment
Here TRANSPORT_IQN_LEN is 224, which is a multiple of 4.
Since vhost_tpgt is 2 bytes and abi_version is 4, the total size would
be 230. But gcc needs struct size be aligned to first field size, which
is 4 bytes, so it pads the structure by extra 2 bytes to the total of
232.
This padding is very undesirable in an ABI:
- it can not be initialized easily
- it can not be checked easily
- it can leak information between kernel and userspace
Simplest solution is probably just to make the padding
explicit.
(v2: Add check for zero'ed backend->reserved field for VHOST_SCSI_SET_ENDPOINT
and VHOST_SCSI_CLEAR_ENDPOINT ops as requested by MST)
Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/vhost')
| -rw-r--r-- | drivers/vhost/tcm_vhost.c | 4 | ||||
| -rw-r--r-- | drivers/vhost/tcm_vhost.h | 1 |
2 files changed, 5 insertions, 0 deletions
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c index 74b2edaaf1f6..ed8e2e6c8df2 100644 --- a/drivers/vhost/tcm_vhost.c +++ b/drivers/vhost/tcm_vhost.c @@ -995,11 +995,15 @@ static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl, case VHOST_SCSI_SET_ENDPOINT: if (copy_from_user(&backend, argp, sizeof backend)) return -EFAULT; + if (backend.reserved != 0) + return -EOPNOTSUPP; return vhost_scsi_set_endpoint(vs, &backend); case VHOST_SCSI_CLEAR_ENDPOINT: if (copy_from_user(&backend, argp, sizeof backend)) return -EFAULT; + if (backend.reserved != 0) + return -EOPNOTSUPP; return vhost_scsi_clear_endpoint(vs, &backend); case VHOST_SCSI_GET_ABI_VERSION: diff --git a/drivers/vhost/tcm_vhost.h b/drivers/vhost/tcm_vhost.h index e9d5c020fb39..d9e93557d669 100644 --- a/drivers/vhost/tcm_vhost.h +++ b/drivers/vhost/tcm_vhost.h @@ -93,6 +93,7 @@ struct vhost_scsi_target { int abi_version; char vhost_wwpn[TRANSPORT_IQN_LEN]; unsigned short vhost_tpgt; + unsigned short reserved; }; /* VHOST_SCSI specific defines */ |