Re: [Qemu-devel] [PATCH v2] scsi: pvscsi: limit process IO loop to ring size

[Paolo Bonzini]

On 14/09/2016 11:39, P J P wrote:
> From: Prasad J Pandit <address@hidden>
> 
> Vmware Paravirtual SCSI emulator while processing IO requests
> could run into an infinite loop if 'pvscsi_ring_pop_req_descr'
> always returned positive value. Limit IO loop to the ring size.
> 
> Reported-by: Li Qiang <address@hidden>
> Signed-off-by: Prasad J Pandit <address@hidden>
> ---
>  hw/scsi/vmw_pvscsi.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> Update per:
>   -> https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg02711.html

Thanks, queued for 2.8.

Cc: address@hidden

Paolo

> diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
> index 4245c15..4d94b36 100644
> --- a/hw/scsi/vmw_pvscsi.c
> +++ b/hw/scsi/vmw_pvscsi.c
> @@ -245,8 +245,11 @@ static hwaddr
>  pvscsi_ring_pop_req_descr(PVSCSIRingInfo *mgr)
>  {
>      uint32_t ready_ptr = RS_GET_FIELD(mgr, reqProdIdx);
> +    uint32_t ring_size = PVSCSI_MAX_NUM_PAGES_REQ_RING
> +                            * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
>  
> -    if (ready_ptr != mgr->consumed_ptr) {
> +    if (ready_ptr != mgr->consumed_ptr
> +        && ready_ptr - mgr->consumed_ptr < ring_size) {
>          uint32_t next_ready_ptr =
>              mgr->consumed_ptr++ & mgr->txr_len_mask;
>          uint32_t next_ready_page =
>