[Devel] [PATCH hci-8.1 v2 3/3] drivers/vhost/blk: take req->len from one side of the descriptor chain

[Alexander Ivanov]

req->len covered the whole descriptor chain, so both readable and
writable data buffers became the payload. A read wrote disk data into
device-readable buffers and reported them as used, a write sent the
guest's writable buffers to disk.

Take write data only from the readable part and the payload of other
requests only from the writable part, as QEMU does. Read the status
byte from the end of the writable part.

Complete a read or write with VIRTIO_BLK_S_IOERR if its payload is
empty, above ALIGN_DOWN(INT_MAX, SECTOR_SIZE) or, for a write, not a
multiple of SECTOR_SIZE. An empty payload used to fail in bio setup
and an unaligned write hit a WARN_ONCE() reachable from the guest.
In both cases the kick handler broke out with the descriptor consumed
and notifications disabled, so the virtqueue stalled. Drop the
WARN_ONCE().

The size bound is new for writes: the readable side had no limit and
a write of any size was submitted. Reads above INT_MAX still get
-EINVAL from the in_len check, the bound only covers the range below
it.

https://virtuozzo.atlassian.net/browse/VSTOR-142755
Fixes: 1629db092dd7 ("drivers/vhost: vhost-blk accelerator for virtio-blk guests")
Fixes: 02ce37f62707 ("vhost-blk: add bounce-buffer for non-aligned requests")
Feature: vhost-blk: in-kernel accelerator for virtio-blk guests
Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>
---
 drivers/vhost/blk.c | 43 ++++++++++++++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 13 deletions(-)

diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c
index 94317a5f2cb6..3448910f9046 100644
--- a/drivers/vhost/blk.c
+++ b/drivers/vhost/blk.c
@@ -277,12 +277,6 @@ static int vhost_blk_bio_make(struct vhost_blk_req *req,
 	if (unlikely(req->bi_opf & REQ_PREFLUSH))
 		return vhost_blk_bio_make_simple(req, bdev);
 
-	if (req->bi_opf == REQ_OP_WRITE && !IS_ALIGNED(req->len, SECTOR_SIZE)) {
-		WARN_ONCE(1, "vhost-blk: write requests with unaligned len"
-			  " are not supported, len = %zu", req->len);
-		return -EINVAL;
-	}
-
 	/*
 	 * Requests with unaligned io vectors are not supported by underlined
 	 * block device, let's use an aligned intermediary "bounce buffer" to
@@ -450,10 +444,10 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
 	struct vhost_blk *blk = container_of(vq->dev, struct vhost_blk, dev);
 	struct vhost_blk_vq *blk_vq = container_of(vq, struct vhost_blk_vq, vq);
 	struct vhost_blk_req *req;
-	u16 total_iov_nr = out + in;
+	struct iovec *data_iov, *st;
 	struct iov_iter iter;
 	size_t in_len;
-	int ret, len;
+	int ret, len, data_nr;
 	u32 type;
 	u8 status;
 
@@ -470,14 +464,37 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
 	if (in_len < sizeof(status) || in_len > INT_MAX)
 		return -EINVAL;
 
-	req->len	= iov_length(vq->iov, total_iov_nr) - sizeof(status);
-	req->iov_nr	= move_iovec(vq->iov, req->iov, req->len, total_iov_nr,
+	/* The status is the last byte of the device-writable part */
+	for (st = vq->iov + out + in - 1; !st->iov_len; st--)
+		;
+	st->iov_len -= sizeof(status);
+	req->status[0].iov_base = st->iov_base + st->iov_len;
+	req->status[0].iov_len = sizeof(status);
+
+	if (type == VIRTIO_BLK_T_OUT) {
+		data_iov = vq->iov;
+		data_nr = out;
+	} else {
+		data_iov = vq->iov + out;
+		data_nr = in;
+	}
+
+	req->len = iov_length(data_iov, data_nr);
+
+	if ((type == VIRTIO_BLK_T_IN || type == VIRTIO_BLK_T_OUT) &&
+	    (!req->len || req->len > ALIGN_DOWN(INT_MAX, SECTOR_SIZE) ||
+	     (type == VIRTIO_BLK_T_OUT && !IS_ALIGNED(req->len, SECTOR_SIZE)))) {
+		ret = vhost_blk_set_status(req, VIRTIO_BLK_S_IOERR);
+		if (!ret)
+			vhost_add_used_and_signal(&blk->dev, vq, head, sizeof(status));
+		return ret;
+	}
+
+	req->iov_nr	= move_iovec(data_iov, req->iov, req->len, data_nr,
 				     ARRAY_SIZE(blk_vq->iov));
 	req->bb		= NULL;
 
-	ret = move_iovec(vq->iov, req->status, sizeof(status), total_iov_nr,
-			 ARRAY_SIZE(req->status));
-	if (ret < 0 || req->iov_nr < 0)
+	if (req->iov_nr < 0)
 		return -EINVAL;
 
 	switch (type) {
-- 
2.53.0