[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 15/19] virtio-scsi: Fix assert in virtio_scsi_push_ev
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 15/19] virtio-scsi: Fix assert in virtio_scsi_push_event |
Date: |
Wed, 18 Mar 2015 12:25:02 +0100 |
From: Fam Zheng <address@hidden>
Hotplugging a scsi-disk may trigger the assertion in qemu_sgl_concat.
qemu-system-x86_64: qemu/hw/scsi/virtio-scsi.c:115: qemu_sgl_concat:
Assertion `skip == 0' failed.
This is introduced by commit 55783a55 (virtio-scsi: work around bug in
old BIOSes) which didn't check out_num when accessing out_sg[0].iov_len
(the same to in sg). For virtio_scsi_push_event, looking into out_sg
doesn't make sense because 0 req_size is intended.
Cc: address@hidden
[Cc'ing qemu-stable because 55783a55 did it too]
Signed-off-by: Fam Zheng <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/scsi/virtio-scsi.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index da0cff8..c9bea06 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -146,8 +146,12 @@ static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
* TODO: always disable this workaround for virtio 1.0 devices.
*/
if (!virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
- req_size = req->elem.out_sg[0].iov_len;
- resp_size = req->elem.in_sg[0].iov_len;
+ if (req->elem.out_num) {
+ req_size = req->elem.out_sg[0].iov_len;
+ }
+ if (req->elem.in_num) {
+ resp_size = req->elem.in_sg[0].iov_len;
+ }
}
out_size = qemu_sgl_concat(req, req->elem.out_sg,
--
2.3.0
- [Qemu-devel] [PULL 05/19] nbd: Pass return value from nbd_handle_list(), (continued)
- [Qemu-devel] [PULL 05/19] nbd: Pass return value from nbd_handle_list(), Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 03/19] qemu-nbd: Detect unused partitions by system == 0, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 02/19] util/uri: Add overflow check to rfc3986_parse_port, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 08/19] nbd: Fix potential signed overflow issues, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 09/19] nbd: Set block size to BDRV_SECTOR_SIZE, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 10/19] nbd: Fix nbd_receive_options(), Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 06/19] nbd: Handle blk_getlength() failure, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 07/19] qemu-nbd: fork() can fail, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 14/19] build: pass .d file name to scripts/make_device_config.sh, fix makefile target, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 11/19] nbd: Fix interpretation of the export flags, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 15/19] virtio-scsi: Fix assert in virtio_scsi_push_event,
Paolo Bonzini <=
- [Qemu-devel] [PULL 12/19] nbd: Drop unexpected data for NBD_OPT_LIST, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 18/19] virtio-scsi-dataplane: fix memory leak in virtio_scsi_vring_init, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 19/19] exec: Respect as_tranlsate_internal length clamp, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 16/19] kvm: fix ioeventfd endianness on bi-endian architectures, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 17/19] profiler: Reenable built-in profiler, Paolo Bonzini, 2015/03/18
- [Qemu-devel] [PULL 13/19] coroutine-io: Return -errno in case of error, Paolo Bonzini, 2015/03/18
- Re: [Qemu-devel] [PULL 00/19] Misc bugfixes for 2.3.0-rc1, Peter Maydell, 2015/03/19