On Thu, 30 Nov 2017 16:08:44 +0100 Igor Mammedov <imamm...@redhat.com> wrote: [...] > > (The logic in vhost_verify_ring_mappings doesn't make sense > > to me either though; if vhost_verify_ring_part_mapping returns 0 > > on success, why is it doing if (!r) { break; } surely it > > should be if (r) { break; }) > it looks like a bug (CCing Greg) >
Wow! It's obviously a bug indeed and I'm amazed it didn't get caught during the review :-\ I'll send a patch ASAP. > before (f1f9e6c5 vhost: adapt vhost_verify_ring_mappings() to virtio 1 ring > layout) > logic used to be > > if changed_*_addr doesn't contain ring > "IGNORE as we don't care" > > if changed_*_addr contain ring AND ring can't be mapped at the same place > ABORT > > with f1f9e6c5 we have 3 rings so on any of them following could happen > if "IGNORE as we don't care" > break => false success > since it's possible that the remaining rings in vq do overlap and didn't > get checked >