diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2022-09-15 19:09:39 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2022-11-25 13:01:21 -0500 |
| commit | e3bf3df824675ea9cadc3cd2c75d08ee83a6ae26 (patch) | |
| tree | 8381ddc6da23024e256bc78cd71ce570decc2f0e | |
| parent | b676668d99155e6859d99bbf2df18b3f03851902 (diff) | |
[vhost] fix 'direction' argument of iov_iter_{init,bvec}()
READ means "data destination", WRITE - "data source".
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| -rw-r--r-- | drivers/vhost/vhost.c | 6 | ||||
| -rw-r--r-- | drivers/vhost/vringh.c | 4 |
2 files changed, 5 insertions, 5 deletions
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 40097826cff0..da0ff415b0a1 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -832,7 +832,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to, VHOST_ACCESS_WO); if (ret < 0) goto out; - iov_iter_init(&t, WRITE, vq->iotlb_iov, ret, size); + iov_iter_init(&t, READ, vq->iotlb_iov, ret, size); ret = copy_to_iter(from, size, &t); if (ret == size) ret = 0; @@ -871,7 +871,7 @@ static int vhost_copy_from_user(struct vhost_virtqueue *vq, void *to, (unsigned long long) size); goto out; } - iov_iter_init(&f, READ, vq->iotlb_iov, ret, size); + iov_iter_init(&f, WRITE, vq->iotlb_iov, ret, size); ret = copy_from_iter(to, size, &f); if (ret == size) ret = 0; @@ -2135,7 +2135,7 @@ static int get_indirect(struct vhost_virtqueue *vq, vq_err(vq, "Translation failure %d in indirect.\n", ret); return ret; } - iov_iter_init(&from, READ, vq->indirect, ret, len); + iov_iter_init(&from, WRITE, vq->indirect, ret, len); count = len / sizeof desc; /* Buffers are chained via a 16 bit next field, so * we can have at most 2^16 of these. */ diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 11f59dd06a74..8be8f30a78f7 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -1162,7 +1162,7 @@ static inline int copy_from_iotlb(const struct vringh *vrh, void *dst, else if (ret < 0) return ret; - iov_iter_bvec(&iter, READ, iov, ret, translated); + iov_iter_bvec(&iter, WRITE, iov, ret, translated); ret = copy_from_iter(dst, translated, &iter); if (ret < 0) @@ -1195,7 +1195,7 @@ static inline int copy_to_iotlb(const struct vringh *vrh, void *dst, else if (ret < 0) return ret; - iov_iter_bvec(&iter, WRITE, iov, ret, translated); + iov_iter_bvec(&iter, READ, iov, ret, translated); ret = copy_to_iter(src, translated, &iter); if (ret < 0) |