[Devel] [PATCH hci-8.1 2/3] drivers/vhost/blk: take virtio_blk_outhdr only from the readable part

[Alexander Ivanov]

The request header was moved from the whole descriptor chain, so a
chain with no readable part, or one shorter than the header, had header
bytes read from buffers the guest marked device-writable. Those bytes
were also trimmed in place from the writable segments, shifting the
status byte and the READ/GET_ID payload taken from them.

Take the header only from the readable part. When that part is shorter
than struct virtio_blk_outhdr, drop the request and report it through
error_ctx, like the other malformed-header paths do.

https://virtuozzo.atlassian.net/browse/VSTOR-142755
Fixes: 1629db092dd7 ("drivers/vhost: vhost-blk accelerator for virtio-blk guests")
Feature: vhost-blk: in-kernel accelerator for virtio-blk guests
Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>
---
 drivers/vhost/blk.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c
index 7234213924d5..94317a5f2cb6 100644
--- a/drivers/vhost/blk.c
+++ b/drivers/vhost/blk.c
@@ -554,7 +554,12 @@ static void vhost_blk_handle_guest_kick(struct vhost_work *work)
 			break;
 		}
 
-		ret = move_iovec(vq->iov, hdr_iovec, sizeof(hdr), in + out, ARRAY_SIZE(hdr_iovec));
+		if (iov_length(vq->iov, out) < sizeof(hdr)) {
+			vhostblk_vq_err(blk, vq, "virtio_blk_hdr (head %d) is missing!", head);
+			break;
+		}
+
+		ret = move_iovec(vq->iov, hdr_iovec, sizeof(hdr), out, ARRAY_SIZE(hdr_iovec));
 		if (ret < 0) {
 			vhostblk_vq_err(blk, vq, "virtio_blk_hdr (head %d) is too split!", head);
 			break;
-- 
2.53.0