From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46755) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZIKmo-0004hw-GS for qemu-devel@nongnu.org; Thu, 23 Jul 2015 14:00:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZIKml-0005TQ-B8 for qemu-devel@nongnu.org; Thu, 23 Jul 2015 14:00:02 -0400 Received: from mx1.redhat.com ([209.132.183.28]:41736) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZIKml-0005Sz-5p for qemu-devel@nongnu.org; Thu, 23 Jul 2015 13:59:59 -0400 Date: Thu, 23 Jul 2015 20:59:55 +0300 From: "Michael S. Tsirkin" Message-ID: <1437674374-23285-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] [PATCH] virtio-9p: fix any_layout List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Jason Wang , "Aneesh Kumar K.V" virtio pci allows any device to have a modern interface, this in turn requires ANY_LAYOUT support. Fix up ANY_LAYOUT for virtio-9p. Reported-by: Jason Wang Signed-off-by: Michael S. Tsirkin --- Lightly tested. hw/9pfs/virtio-9p.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/hw/9pfs/virtio-9p.c b/hw/9pfs/virtio-9p.c index 6ef8af3..7a3171f 100644 --- a/hw/9pfs/virtio-9p.c +++ b/hw/9pfs/virtio-9p.c @@ -3261,16 +3261,26 @@ void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq) while ((pdu = alloc_pdu(s)) && (len = virtqueue_pop(vq, &pdu->elem)) != 0) { - uint8_t *ptr; + struct { + uint32_t size_le; + uint8_t id; + uint16_t tag_le; + } QEMU_PACKED out; + int len; + pdu->s = s; BUG_ON(pdu->elem.out_num == 0 || pdu->elem.in_num == 0); - BUG_ON(pdu->elem.out_sg[0].iov_len < 7); + QEMU_BUILD_BUG_ON(sizeof out != 7); + + len = iov_to_buf(pdu->elem.out_sg, pdu->elem.out_num, 0, + &out, sizeof out); + BUG_ON(len != sizeof out); + + pdu->size = le32_to_cpu(out.size_le); - ptr = pdu->elem.out_sg[0].iov_base; + pdu->id = out.id; + pdu->tag = le16_to_cpu(out.tag_le); - pdu->size = le32_to_cpu(*(uint32_t *)ptr); - pdu->id = ptr[4]; - pdu->tag = le16_to_cpu(*(uint16_t *)(ptr + 5)); qemu_co_queue_init(&pdu->complete); submit_pdu(s, pdu); } -- MST