Skip to content

Commit 7aed44b

Browse files
stefano-garzarelladavem330
authored andcommitted
vringh: don't use vringh_kiov_advance() in vringh_iov_xfer()
In the while loop of vringh_iov_xfer(), `partlen` could be 0 if one of the `iov` has 0 lenght. In this case, we should skip the iov and go to the next one. But calling vringh_kiov_advance() with 0 lenght does not cause the advancement, since it returns immediately if asked to advance by 0 bytes. Let's restore the code that was there before commit b8c06ad ("vringh: implement vringh_kiov_advance()"), avoiding using vringh_kiov_advance(). Fixes: b8c06ad ("vringh: implement vringh_kiov_advance()") Cc: [email protected] Reported-by: Jason Wang <[email protected]> Signed-off-by: Stefano Garzarella <[email protected]> Acked-by: Jason Wang <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent a0c55bb commit 7aed44b

File tree

1 file changed

+11
-1
lines changed

1 file changed

+11
-1
lines changed

drivers/vhost/vringh.c

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,18 @@ static inline ssize_t vringh_iov_xfer(struct vringh *vrh,
123123
done += partlen;
124124
len -= partlen;
125125
ptr += partlen;
126+
iov->consumed += partlen;
127+
iov->iov[iov->i].iov_len -= partlen;
128+
iov->iov[iov->i].iov_base += partlen;
126129

127-
vringh_kiov_advance(iov, partlen);
130+
if (!iov->iov[iov->i].iov_len) {
131+
/* Fix up old iov element then increment. */
132+
iov->iov[iov->i].iov_len = iov->consumed;
133+
iov->iov[iov->i].iov_base -= iov->consumed;
134+
135+
iov->consumed = 0;
136+
iov->i++;
137+
}
128138
}
129139
return done;
130140
}

0 commit comments

Comments
 (0)