Commit d251157a authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Paolo Bonzini
Browse files

scsi: pvscsi: limit process IO loop to ring size 



Vmware Paravirtual SCSI emulator while processing IO requests
could run into an infinite loop if 'pvscsi_ring_pop_req_descr'
always returned positive value. Limit IO loop to the ring size.

Cc: qemu-stable@nongnu.org
Reported-by: default avatarLi Qiang <liqiang6-s@360.cn>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-Id: <1473845952-30785-1-git-send-email-ppandit@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 58268c8d

hw/scsi/vmw_pvscsi.c

+4 −1
Original line number Diff line number Diff line
@@ -247,8 +247,11 @@ static hwaddr 
pvscsi_ring_pop_req_descr(PVSCSIRingInfo *mgr)

{

    uint32_t ready_ptr = RS_GET_FIELD(mgr, reqProdIdx);

    uint32_t ring_size = PVSCSI_MAX_NUM_PAGES_REQ_RING

                            * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;



    if (ready_ptr != mgr->consumed_ptr) {

    if (ready_ptr != mgr->consumed_ptr

        && ready_ptr - mgr->consumed_ptr < ring_size) {

        uint32_t next_ready_ptr =

            mgr->consumed_ptr++ & mgr->txr_len_mask;

        uint32_t next_ready_page =