Commit 0d78289c authored by Greg Kurz's avatar Greg Kurz
Browse files

9pfs: fix off-by-one error in PDU free list 



The server can handle MAX_REQ - 1 PDUs at a time and the virtio-9p
device has a MAX_REQ sized virtqueue. If the client manages to fill
up the virtqueue, pdu_alloc() will fail and the request won't be
processed without any notice to the client (it actually causes the
linux 9p client to hang).

This has been there since the beginning (commit 9f107513 "virtio-9p:
Add a virtio 9p device to qemu"), but it needs an agressive workload to
run in the guest to show up.

We actually allocate MAX_REQ PDUs and I see no reason not to link them
all into the free list, so let's fix the init loop.

Reported-by: default avatarTuomas Tynkkynen <tuomas@tuxera.com>
Suggested-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
parent 6e37f458

hw/9pfs/9p.c

+1 −1
Original line number Diff line number Diff line
@@ -3454,7 +3454,7 @@ int v9fs_device_realize_common(V9fsState *s, Error **errp) 
    /* initialize pdu allocator */

    QLIST_INIT(&s->free_list);

    QLIST_INIT(&s->active_list);

    for (i = 0; i < (MAX_REQ - 1); i++) {

    for (i = 0; i < MAX_REQ; i++) {

        QLIST_INSERT_HEAD(&s->free_list, &s->pdus[i], next);

        s->pdus[i].s = s;

        s->pdus[i].idx = i;