[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] ide: avoid unbounded recursion
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PATCH] ide: avoid unbounded recursion |
Date: |
Thu, 12 Jan 2017 11:51:32 +0100 |
The end_transfer_func can call ide_transfer_start immediately, before
returning, and unbounded recursion can happen at least for
ide_atapi_cmd_reply_end. Use a bottom half to defer the call and
limit stack usage.
Cc: Peter Lieven <address@hidden>
Cc: John Snow <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/ide/core.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 43709e5..7b9831f 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -482,6 +482,13 @@ static void ide_clear_retry(IDEState *s)
s->bus->retry_nsector = 0;
}
+static void ide_start_transfer_bh_cb(void *opaque)
+{
+ IDEDMA *dma = opaque;
+
+ dma->ops->start_transfer(dma);
+}
+
/* prepare data transfer and tell what to do after */
void ide_transfer_start(IDEState *s, uint8_t *buf, int size,
EndTransferFunc *end_transfer_func)
@@ -494,7 +501,12 @@ void ide_transfer_start(IDEState *s, uint8_t *buf, int
size,
s->status |= DRQ_STAT;
}
if (s->bus->dma->ops->start_transfer) {
- s->bus->dma->ops->start_transfer(s->bus->dma);
+ /* There can be unbounded recursion between ops->start_transfer
+ * and end_transfer_func, so defer to a bottom half.
+ */
+ aio_bh_schedule_oneshot(qemu_get_aio_context(),
+ ide_start_transfer_bh_cb,
+ s->bus->dma);
}
}
--
2.9.3
- [Qemu-devel] [PATCH] ide: avoid unbounded recursion,
Paolo Bonzini <=