Re: ptr_ring_unconsume: memory corruption potential?

["Michael S. Tsirkin" <mst@redhat.com>]

On Tue, Sep 23, 2025 at 11:58:40PM -0400, Michael S. Tsirkin wrote:
> Jason, guys,
> reading ptr ring code, I noticed:
> 


Pls ignore. ENOTENOUGHCOFFEE. It's a nop.



> static inline void ptr_ring_unconsume(struct ptr_ring *r, void **batch, int n,
>                                       void (*destroy)(void *))
> {
>         unsigned long flags;
>         int head;
>                 
>         spin_lock_irqsave(&r->consumer_lock, flags);
>         spin_lock(&r->producer_lock);
> 
>         if (!r->size)
>                 goto done;
>                 
>         /*
>          * Clean out buffered entries (for simplicity). This way following code
>          * can test entries for NULL and if not assume they are valid.
>          */     
>         head = r->consumer_head - 1;
>         while (likely(head >= r->consumer_tail))
>                 r->queue[head--] = NULL;
>                 __ptr_ring_update(r, head);
>         r->consumer_tail = r->consumer_head;
> 
> 
> ...
> 
> 
> 
> Does not look like this will DTRT if r->consumer_head == 0 .
> In fact it looks like it will go off corrupting memory.
> 
> Why isn't this a concern?
> 
> -- 
> MST