[Qemu-devel] [PATCH] virtio-scsi: Fix assert in virtio_scsi_push_event

[Qemu-devel] [PATCH] virtio-scsi: Fix assert in virtio_scsi_push_event

[Fam Zheng]

Hotplugging a scsi-disk may trigger the assertion in qemu_sgl_concat.

    qemu-system-x86_64: qemu/hw/scsi/virtio-scsi.c:115: qemu_sgl_concat:
    Assertion `skip == 0' failed.

This is introduced by commit 55783a55 (virtio-scsi: work around bug in
old BIOSes) which didn't check out_num when accessing out_sg[0].iov_len
(the same to in sg). For virtio_scsi_push_event, looking into out_sg
doesn't make sense because 0 req_size is intended.

Cc: qemu-stable@nongnu.org
[Cc'ing qemu-stable because 55783a55 did it too]
Signed-off-by: Fam Zheng <famz@redhat.com>
---
 hw/scsi/virtio-scsi.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index da0cff8..c9bea06 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -146,8 +146,12 @@ static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
      * TODO: always disable this workaround for virtio 1.0 devices.
      */
     if (!virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
-        req_size = req->elem.out_sg[0].iov_len;
-        resp_size = req->elem.in_sg[0].iov_len;
+        if (req->elem.out_num) {
+            req_size = req->elem.out_sg[0].iov_len;
+        }
+        if (req->elem.in_num) {
+            resp_size = req->elem.in_sg[0].iov_len;
+        }
     }
 
     out_size = qemu_sgl_concat(req, req->elem.out_sg,
-- 
1.9.3

Re: [Qemu-devel] [PATCH] virtio-scsi: Fix assert in virtio_scsi_push_event

[Paolo Bonzini]

On 13/03/2015 08:55, Fam Zheng wrote:
> Hotplugging a scsi-disk may trigger the assertion in qemu_sgl_concat.
> 
>     qemu-system-x86_64: qemu/hw/scsi/virtio-scsi.c:115: qemu_sgl_concat:
>     Assertion `skip == 0' failed.
> 
> This is introduced by commit 55783a55 (virtio-scsi: work around bug in
> old BIOSes) which didn't check out_num when accessing out_sg[0].iov_len
> (the same to in sg). For virtio_scsi_push_event, looking into out_sg
> doesn't make sense because 0 req_size is intended.
> 
> Cc: qemu-stable@nongnu.org
> [Cc'ing qemu-stable because 55783a55 did it too]
> Signed-off-by: Fam Zheng <famz@redhat.com>
> ---
>  hw/scsi/virtio-scsi.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
> index da0cff8..c9bea06 100644
> --- a/hw/scsi/virtio-scsi.c
> +++ b/hw/scsi/virtio-scsi.c
> @@ -146,8 +146,12 @@ static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
>       * TODO: always disable this workaround for virtio 1.0 devices.
>       */
>      if (!virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
> -        req_size = req->elem.out_sg[0].iov_len;
> -        resp_size = req->elem.in_sg[0].iov_len;
> +        if (req->elem.out_num) {
> +            req_size = req->elem.out_sg[0].iov_len;
> +        }
> +        if (req->elem.in_num) {
> +            resp_size = req->elem.in_sg[0].iov_len;
> +        }
>      }
>  
>      out_size = qemu_sgl_concat(req, req->elem.out_sg,
> 

Thanks, I'll send a pull request next week.

Paolo