[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 4/5] ide: Fix crash with too long PRD
From: |
Stefan Hajnoczi |
Subject: |
[Qemu-devel] [PATCH 4/5] ide: Fix crash with too long PRD |
Date: |
Wed, 21 Nov 2012 11:12:31 +0100 |
From: Kevin Wolf <address@hidden>
Without this, s->nsector can become negative and badness happens (trying
to malloc huge amount of memory and glib calls abort())
Signed-off-by: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
hw/ide/core.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 7d6b0fa..c2ab787 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -579,6 +579,7 @@ void ide_dma_cb(void *opaque, int ret)
IDEState *s = opaque;
int n;
int64_t sector_num;
+ bool stay_active = false;
if (ret < 0) {
int op = BM_STATUS_DMA_RETRY;
@@ -594,6 +595,14 @@ void ide_dma_cb(void *opaque, int ret)
}
n = s->io_buffer_size >> 9;
+ if (n > s->nsector) {
+ /* The PRDs were longer than needed for this request. Shorten them so
+ * we don't get a negative remainder. The Active bit must remain set
+ * after the request completes. */
+ n = s->nsector;
+ stay_active = true;
+ }
+
sector_num = ide_get_sector(s);
if (n > 0) {
dma_buf_commit(s);
@@ -646,6 +655,9 @@ eot:
bdrv_acct_done(s->bs, &s->acct);
}
ide_set_inactive(s);
+ if (stay_active) {
+ s->bus->dma->ops->add_status(s->bus->dma, BM_STATUS_DMAING);
+ }
}
static void ide_sector_start_dma(IDEState *s, enum ide_dma_cmd dma_cmd)
--
1.8.0
- [Qemu-devel] [PULL 1.3-rc1 0/5] Block patches for QEMU 1.3-rc1, Stefan Hajnoczi, 2012/11/21
- [Qemu-devel] [PATCH 2/5] vdi: don't override libuuid symbols, Stefan Hajnoczi, 2012/11/21
- [Qemu-devel] [PATCH 4/5] ide: Fix crash with too long PRD,
Stefan Hajnoczi <=
- [Qemu-devel] [PATCH 1/5] block: add bdrv_reopen() support for raw hdev, floppy, and cdrom, Stefan Hajnoczi, 2012/11/21
- [Qemu-devel] [PATCH 3/5] use int64_t for return values from rbd instead of int, Stefan Hajnoczi, 2012/11/21
- [Qemu-devel] [PATCH 5/5] ide: Fix status register after short PRDs, Stefan Hajnoczi, 2012/11/21
- Re: [Qemu-devel] [PULL 1.3-rc1 0/5] Block patches for QEMU 1.3-rc1, Anthony Liguori, 2012/11/26