Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

Pull virtio/vhost fixes and cleanups from Michael Tsirkin:
 "Misc fixes and cleanups all over the place"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  virtio/s390: deprecate old transport
  virtio/s390: keep early_put_chars
  virtio_blk: Fix a slient kernel panic
  virtio-vsock: fix include guard typo
  vhost/vsock: fix vhost virtio_vsock_pkt use-after-free
  9p/trans_virtio: use kvfree() for iov_iter_get_pages_alloc()
  virtio: fix error handling for debug builds
  virtio: fix memory leak in virtqueue_add()

8 files changed, 40 insertions, 24 deletions

diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 0e348781327b..e751fe25d6ab 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -872,4 +872,17 @@ config S390_GUEST
           Select this option if you want to run the kernel as a guest under
           the KVM hypervisor.
 
+config S390_GUEST_OLD_TRANSPORT
+        def_bool y
+        prompt "Guest support for old s390 virtio transport (DEPRECATED)"
+        depends on S390_GUEST
+        help
+          Enable this option to add support for the old s390-virtio
+          transport (i.e. virtio devices NOT based on virtio-ccw). This
+          type of virtio devices is only available on the experimental
+          kuli userspace or with old (< 2.6) qemu. If you are running
+          with a modern version of qemu (which supports virtio-ccw since
+          1.4 and uses it by default since version 2.4), you probably won't
+          need this.
+
 endmenu
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 1523e05c46fc..93b1aaa5ba3b 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -391,22 +391,16 @@ static int init_vq(struct virtio_blk *vblk)
                 num_vqs = 1;
 
         vblk->vqs = kmalloc(sizeof(*vblk->vqs) * num_vqs, GFP_KERNEL);
-        if (!vblk->vqs) {
-                err = -ENOMEM;
-                goto out;
-        }
+        if (!vblk->vqs)
+                return -ENOMEM;
 
         names = kmalloc(sizeof(*names) * num_vqs, GFP_KERNEL);
-        if (!names)
-                goto err_names;
-
         callbacks = kmalloc(sizeof(*callbacks) * num_vqs, GFP_KERNEL);
-        if (!callbacks)
-                goto err_callbacks;
-
         vqs = kmalloc(sizeof(*vqs) * num_vqs, GFP_KERNEL);
-        if (!vqs)
-                goto err_vqs;
+        if (!names || !callbacks || !vqs) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         for (i = 0; i < num_vqs; i++) {
                 callbacks[i] = virtblk_done;
@@ -417,7 +411,7 @@ static int init_vq(struct virtio_blk *vblk)
         /* Discover virtqueues and write information to configuration.  */
         err = vdev->config->find_vqs(vdev, num_vqs, vqs, callbacks, names);
         if (err)
-                goto err_find_vqs;
+                goto out;
 
         for (i = 0; i < num_vqs; i++) {
                 spin_lock_init(&vblk->vqs[i].lock);
@@ -425,16 +419,12 @@ static int init_vq(struct virtio_blk *vblk)
         }
         vblk->num_vqs = num_vqs;
 
- err_find_vqs:
+out:
         kfree(vqs);
- err_vqs:
         kfree(callbacks);
- err_callbacks:
         kfree(names);
- err_names:
         if (err)
                 kfree(vblk->vqs);
- out:
         return err;
 }
 
diff --git a/drivers/s390/virtio/Makefile b/drivers/s390/virtio/Makefile
index 241891a57caf..df40692a9011 100644
--- a/drivers/s390/virtio/Makefile
+++ b/drivers/s390/virtio/Makefile
@@ -6,4 +6,8 @@
 # it under the terms of the GNU General Public License (version 2 only)
 # as published by the Free Software Foundation.
 
-obj-$(CONFIG_S390_GUEST) += kvm_virtio.o virtio_ccw.o
+s390-virtio-objs := virtio_ccw.o
+ifdef CONFIG_S390_GUEST_OLD_TRANSPORT
+s390-virtio-objs += kvm_virtio.o
+endif
+obj-$(CONFIG_S390_GUEST) += $(s390-virtio-objs)
diff --git a/drivers/s390/virtio/kvm_virtio.c b/drivers/s390/virtio/kvm_virtio.c
index 1d060fd293a3..5e5c11f37b24 100644
--- a/drivers/s390/virtio/kvm_virtio.c
+++ b/drivers/s390/virtio/kvm_virtio.c
@@ -458,6 +458,8 @@ static int __init kvm_devices_init(void)
         if (test_devices_support(total_memory_size) < 0)
                 return -ENODEV;
 
+        pr_warn("The s390-virtio transport is deprecated. Please switch to a modern host providing virtio-ccw.\n");
+
         rc = vmem_add_mapping(total_memory_size, PAGE_SIZE);
         if (rc)
                 return rc;
@@ -482,7 +484,7 @@ static int __init kvm_devices_init(void)
 }
 
 /* code for early console output with virtio_console */
-static __init int early_put_chars(u32 vtermno, const char *buf, int count)
+static int early_put_chars(u32 vtermno, const char *buf, int count)
 {
         char scratch[17];
         unsigned int len = count;
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 0ddf3a2dbfc4..e3b30ea9ece5 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -307,6 +307,8 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
 
         vhost_disable_notify(&vsock->dev, vq);
         for (;;) {
+                u32 len;
+
                 if (!vhost_vsock_more_replies(vsock)) {
                         /* Stop tx until the device processes already
                          * pending replies.  Leave tx virtqueue
@@ -334,13 +336,15 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
                         continue;
                 }
 
+                len = pkt->len;
+
                 /* Only accept correctly addressed packets */
                 if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid)
                         virtio_transport_recv_pkt(pkt);
                 else
                         virtio_transport_free_pkt(pkt);
 
-                vhost_add_used(vq, head, sizeof(pkt->hdr) + pkt->len);
+                vhost_add_used(vq, head, sizeof(pkt->hdr) + len);
                 added = true;
         }
 
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 114a0c88afb8..e383ecdaca59 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -327,6 +327,8 @@ static inline int virtqueue_add(struct virtqueue *_vq,
                  * host should service the ring ASAP. */
                 if (out_sgs)
                         vq->notify(&vq->vq);
+                if (indirect)
+                        kfree(desc);
                 END_USE(vq);
                 return -ENOSPC;
         }
@@ -426,6 +428,7 @@ unmap_release:
         if (indirect)
                 kfree(desc);
 
+        END_USE(vq);
         return -EIO;
 }
 
diff --git a/include/uapi/linux/virtio_vsock.h b/include/uapi/linux/virtio_vsock.h
index 6b011c19b50f..1d57ed3d84d2 100644
--- a/include/uapi/linux/virtio_vsock.h
+++ b/include/uapi/linux/virtio_vsock.h
@@ -32,7 +32,7 @@
  */
 
 #ifndef _UAPI_LINUX_VIRTIO_VSOCK_H
-#define _UAPI_LINUX_VIRTIO_VOSCK_H
+#define _UAPI_LINUX_VIRTIO_VSOCK_H
 
 #include <linux/types.h>
 #include <linux/virtio_ids.h>
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 4acb1d5417aa..f24b25c25106 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -507,8 +507,8 @@ err_out:
                 /* wakeup anybody waiting for slots to pin pages */
                 wake_up(&vp_wq);
         }
-        kfree(in_pages);
-        kfree(out_pages);
+        kvfree(in_pages);
+        kvfree(out_pages);
         return err;
 }