Commit a1001760 authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Michael Roth
Browse files

pvrdma: check return value from pvrdma_idx_ring_has_ routines 



pvrdma_idx_ring_has_[data/space] routines also return invalid
index PVRDMA_INVALID_IDX[=-1], if ring has no data/space. Check
return value from these routines to avoid plausible infinite loops.

Reported-by: default avatarLi Qiang <liq3ea@163.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: default avatarYuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: default avatarMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
(cherry picked from commit f1e2e38e)
Signed-off-by: default avatarMichael Roth <mdroth@linux.vnet.ibm.com>
parent 2a0e6f13

hw/rdma/vmw/pvrdma_dev_ring.c

+11 −18
Original line number Diff line number Diff line
@@ -73,23 +73,16 @@ out: 


void *pvrdma_ring_next_elem_read(PvrdmaRing *ring)

{

    int e;

    unsigned int idx = 0, offset;



    /*

    pr_dbg("%s: t=%d, h=%d\n", ring->name, ring->ring_state->prod_tail,

           ring->ring_state->cons_head);

    */



    if (!pvrdma_idx_ring_has_data(ring->ring_state, ring->max_elems, &idx)) {

    e = pvrdma_idx_ring_has_data(ring->ring_state, ring->max_elems, &idx);

    if (e <= 0) {

        pr_dbg("No more data in ring\n");

        return NULL;

    }



    offset = idx * ring->elem_sz;

    /*

    pr_dbg("idx=%d\n", idx);

    pr_dbg("offset=%d\n", offset);

    */

    return ring->pages[offset / TARGET_PAGE_SIZE] + (offset % TARGET_PAGE_SIZE);

}
@@ -105,20 +98,20 @@ void pvrdma_ring_read_inc(PvrdmaRing *ring) 


void *pvrdma_ring_next_elem_write(PvrdmaRing *ring)

{

    unsigned int idx, offset, tail;

    int idx;

    unsigned int offset, tail;



    /*

    pr_dbg("%s: t=%d, h=%d\n", ring->name, ring->ring_state->prod_tail,

           ring->ring_state->cons_head);

    */



    if (!pvrdma_idx_ring_has_space(ring->ring_state, ring->max_elems, &tail)) {

    idx = pvrdma_idx_ring_has_space(ring->ring_state, ring->max_elems, &tail);

    if (idx <= 0) {

        pr_dbg("CQ is full\n");

        return NULL;

    }



    idx = pvrdma_idx(&ring->ring_state->prod_tail, ring->max_elems);

    /* TODO: tail == idx */

    if (idx < 0 || tail != idx) {

        pr_dbg("invalid idx\n");

        return NULL;

    }



    offset = idx * ring->elem_sz;

    return ring->pages[offset / TARGET_PAGE_SIZE] + (offset % TARGET_PAGE_SIZE);