From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56019) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YYC7C-0007wN-H9 for qemu-devel@nongnu.org; Wed, 18 Mar 2015 07:26:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YYC7B-0001p7-Ik for qemu-devel@nongnu.org; Wed, 18 Mar 2015 07:26:22 -0400 Sender: Paolo Bonzini From: Paolo Bonzini Date: Wed, 18 Mar 2015 12:25:02 +0100 Message-Id: <1426677906-51657-16-git-send-email-pbonzini@redhat.com> In-Reply-To: <1426677906-51657-1-git-send-email-pbonzini@redhat.com> References: <1426677906-51657-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PULL 15/19] virtio-scsi: Fix assert in virtio_scsi_push_event List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Fam Zheng , qemu-stable@nongnu.org From: Fam Zheng Hotplugging a scsi-disk may trigger the assertion in qemu_sgl_concat. qemu-system-x86_64: qemu/hw/scsi/virtio-scsi.c:115: qemu_sgl_concat: Assertion `skip == 0' failed. This is introduced by commit 55783a55 (virtio-scsi: work around bug in old BIOSes) which didn't check out_num when accessing out_sg[0].iov_len (the same to in sg). For virtio_scsi_push_event, looking into out_sg doesn't make sense because 0 req_size is intended. Cc: qemu-stable@nongnu.org [Cc'ing qemu-stable because 55783a55 did it too] Signed-off-by: Fam Zheng Message-Id: <1426233354-525-1-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini --- hw/scsi/virtio-scsi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index da0cff8..c9bea06 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -146,8 +146,12 @@ static int virtio_scsi_parse_req(VirtIOSCSIReq *req, * TODO: always disable this workaround for virtio 1.0 devices. */ if (!virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) { - req_size = req->elem.out_sg[0].iov_len; - resp_size = req->elem.in_sg[0].iov_len; + if (req->elem.out_num) { + req_size = req->elem.out_sg[0].iov_len; + } + if (req->elem.in_num) { + resp_size = req->elem.in_sg[0].iov_len; + } } out_size = qemu_sgl_concat(req, req->elem.out_sg, -- 2.3.0