[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 2/4] xen: fix quad word bufioreq handling
From: |
Stefano Stabellini |
Subject: |
[Qemu-devel] [PULL 2/4] xen: fix quad word bufioreq handling |
Date: |
Mon, 28 Nov 2016 11:42:24 -0800 |
From: Jan Beulich <address@hidden>
We should not consume the second slot if it didn't get written yet.
Normal writers - i.e. Xen - would not update write_pointer between the
two writes, but the page may get fiddled with by the guest itself, and
we're better off avoiding to enter an infinite loop in that case.
Reported-by: yanghongke <address@hidden>
Signed-off-by: Jan Beulich <address@hidden>
Reviewed-by: Paul Durrant <address@hidden>
Reviewed-by: Stefano Stabellini <address@hidden>
Signed-off-by: Stefano Stabellini <address@hidden>
---
xen-hvm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/xen-hvm.c b/xen-hvm.c
index 99b8ee8..d74e233 100644
--- a/xen-hvm.c
+++ b/xen-hvm.c
@@ -1021,6 +1021,9 @@ static int handle_buffered_iopage(XenIOState *state)
xen_rmb();
qw = (req.size == 8);
if (qw) {
+ if (rdptr + 1 == wrptr) {
+ hw_error("Incomplete quad word buffered ioreq");
+ }
buf_req = &buf_page->buf_ioreq[(rdptr + 1) %
IOREQ_BUFFER_SLOT_NUM];
req.data |= ((uint64_t)buf_req->data) << 32;
--
1.9.1