iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[vhost] fix 'direction' argument of iov_iter_{init,bvec}()

Browse Source 
READ means "data destination", WRITE - "data source".

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2022-09-15 19:09:39 -04:00
parent b676668d99
commit e3bf3df824
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/vhost/vhost.c
View File

@ -832,7 +832,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to,
VHOST_ACCESS_WO);
if (ret < 0)
goto out;
iov_iter_init(&t, WRITE, vq->iotlb_iov, ret, size);
iov_iter_init(&t, READ, vq->iotlb_iov, ret, size);
ret = copy_to_iter(from, size, &t);
if (ret == size)
ret = 0;
@ -871,7 +871,7 @@ static int vhost_copy_from_user(struct vhost_virtqueue *vq, void *to,
(unsigned long long) size);
goto out;
}
iov_iter_init(&f, READ, vq->iotlb_iov, ret, size);
iov_iter_init(&f, WRITE, vq->iotlb_iov, ret, size);
ret = copy_from_iter(to, size, &f);
if (ret == size)
ret = 0;
@ -2135,7 +2135,7 @@ static int get_indirect(struct vhost_virtqueue *vq,
vq_err(vq, "Translation failure %d in indirect.\n", ret);
return ret;
}
iov_iter_init(&from, READ, vq->indirect, ret, len);
iov_iter_init(&from, WRITE, vq->indirect, ret, len);
count = len / sizeof desc;
/* Buffers are chained via a 16 bit next field, so
* we can have at most 2^16 of these. */

4
drivers/vhost/vringh.c
View File

@ -1162,7 +1162,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst,
else if (ret < 0)
return ret;
iov_iter_bvec(&iter, READ, iov, ret, translated);
iov_iter_bvec(&iter, WRITE, iov, ret, translated);
ret = copy_from_iter(dst, translated, &iter);
if (ret < 0)
@ -1195,7 +1195,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst,
else if (ret < 0)
return ret;
iov_iter_bvec(&iter, WRITE, iov, ret, translated);
iov_iter_bvec(&iter, READ, iov, ret, translated);
ret = copy_to_iter(src, translated, &iter);
if (ret < 0)