[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] scsi: pvscsi: limit process IO loop to maximum
From: |
P J P |
Subject: |
Re: [Qemu-devel] [PATCH] scsi: pvscsi: limit process IO loop to maximum page count |
Date: |
Tue, 13 Sep 2016 12:30:42 +0530 (IST) |
+-- On Wed, 7 Sep 2016, P J P wrote --+
| From: Prasad J Pandit <address@hidden>
|
| Vmware Paravirtual SCSI emulator while processing IO requests
| could run into an infinite loop if 'pvscsi_ring_pop_req_descr'
| always returned positive value. Limit IO loop to the maximum
| page count.
|
| Reported-by: Li Qiang <address@hidden>
| Signed-off-by: Prasad J Pandit <address@hidden>
| ---
| hw/scsi/vmw_pvscsi.c | 4 +++-
| 1 file changed, 3 insertions(+), 1 deletion(-)
|
| diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
| index babac5a..3e77a08 100644
| --- a/hw/scsi/vmw_pvscsi.c
| +++ b/hw/scsi/vmw_pvscsi.c
| @@ -711,11 +711,13 @@ pvscsi_process_request_descriptor(PVSCSIState *s,
| static void
| pvscsi_process_io(PVSCSIState *s)
| {
| + int descr_pa_cnt = 0;
| PVSCSIRingReqDesc descr;
| hwaddr next_descr_pa;
|
| assert(s->rings_info_valid);
| - while ((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0) {
| + while (((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0)
| + && descr_pa_cnt++ < PVSCSI_SETUP_RINGS_MAX_NUM_PAGES) {
|
| /* Only read after production index verification */
| smp_rmb();
Ping...!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F