[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 48/60] ide: Fix crash with too long PRD
From: |
Michael Tokarev |
Subject: |
[Qemu-devel] [PATCH 48/60] ide: Fix crash with too long PRD |
Date: |
Mon, 4 Feb 2013 14:40:58 +0400 |
From: Kevin Wolf <address@hidden>
Without this, s->nsector can become negative and badness happens (trying
to malloc huge amount of memory and glib calls abort())
Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
(cherry picked from commit 038268e2e8087ee2fd8987a77ba580e15f14c147)
Signed-off-by: Michael Tokarev <address@hidden>
---
hw/ide/core.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 9785d5f..78c869c 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -590,6 +590,7 @@ void ide_dma_cb(void *opaque, int ret)
IDEState *s = opaque;
int n;
int64_t sector_num;
+ bool stay_active = false;
if (ret < 0) {
int op = BM_STATUS_DMA_RETRY;
@@ -605,6 +606,14 @@ void ide_dma_cb(void *opaque, int ret)
}
n = s->io_buffer_size >> 9;
+ if (n > s->nsector) {
+ /* The PRDs were longer than needed for this request. Shorten them so
+ * we don't get a negative remainder. The Active bit must remain set
+ * after the request completes. */
+ n = s->nsector;
+ stay_active = true;
+ }
+
sector_num = ide_get_sector(s);
if (n > 0) {
dma_buf_commit(s);
@@ -657,6 +666,9 @@ eot:
bdrv_acct_done(s->bs, &s->acct);
}
ide_set_inactive(s);
+ if (stay_active) {
+ s->bus->dma->ops->add_status(s->bus->dma, BM_STATUS_DMAING);
+ }
}
static void ide_sector_start_dma(IDEState *s, enum ide_dma_cmd dma_cmd)
--
1.7.10.4
- [Qemu-devel] [PATCH 04/60] configure: Fix CONFIG_QEMU_HELPERDIR generation, (continued)
- [Qemu-devel] [PATCH 04/60] configure: Fix CONFIG_QEMU_HELPERDIR generation, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 22/60] uhci: Raise interrupt when requested even for non active tds, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 54/60] hw/arm_boot.c: Consistently use ram_size from arm_boot_info struct, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 29/60] usb-storage: fix SYNCHRONIZE_CACHE, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 23/60] hw/qxl: qxl_dirty_surfaces: use uintptr_t, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 41/60] mips/malta: fix CBUS UART interrupt pin, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 10/60] pcie_aer: clear cmask for Advanced Error Interrupt Message Number, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 48/60] ide: Fix crash with too long PRD,
Michael Tokarev <=
- [Qemu-devel] [PATCH 35/60] s390x: fix -initrd in virtio machine, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 53/60] hw/qxl: qxl_send_events: nop if stopped, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 17/60] net: notify iothread after flushing queue, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 34/60] memory: fix rendering of a region obscured by another, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 52/60] uhci: Don't queue up packets after one with the SPD flag set, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 47/60] kvm: fix incorrect length in a loop over kvm dirty pages map, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 15/60] i386: kvm: bit 10 of CPUID[8000_0001].EDX is reserved, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 32/60] qed: refuse unaligned zero writes with a backing file, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 16/60] blockdev: preserve readonly and snapshot states across media changes, Michael Tokarev, 2013/02/04
- [Qemu-devel] [PATCH 46/60] e1000: Discard oversized packets based on SBP|LPE, Michael Tokarev, 2013/02/04