From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57516) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1baWJI-0001KK-3H for qemu-devel@nongnu.org; Thu, 18 Aug 2016 19:01:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1baWJC-0005Na-75 for qemu-devel@nongnu.org; Thu, 18 Aug 2016 19:01:15 -0400 Received: from mail-db5eur01on0113.outbound.protection.outlook.com ([104.47.2.113]:46816 helo=EUR01-DB5-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1baWJB-0005ME-In for qemu-devel@nongnu.org; Thu, 18 Aug 2016 19:01:10 -0400 From: Roman Kagan Date: Thu, 18 Aug 2016 21:27:51 +0300 Message-ID: <1471544874-26996-2-git-send-email-rkagan@virtuozzo.com> In-Reply-To: <1471544874-26996-1-git-send-email-rkagan@virtuozzo.com> References: <1471544874-26996-1-git-send-email-rkagan@virtuozzo.com> MIME-Version: 1.0 Content-Type: text/plain Subject: [Qemu-devel] [PATCH 1/4] virtio: assert on ->inuse underflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: "Denis V. Lunev" , Roman Kagan , "Michael S. Tsirkin" , Stefan Hajnoczi Make sure that ->inuse counter on virtqueue never goes negative. This complements commit afd9096eb1882f23929f5b5c177898ed231bac66, "virtio: error out if guest exceeds virtqueue size", which, due to signed ->inuse comparison against unsigned ->vring.num, manifested a bug in virtio-balloon where virtqueue_push() was called before the matching virtqueu_pop(). [That problem will be addressed in followup patches]. Signed-off-by: Roman Kagan Cc: "Michael S. Tsirkin" Cc: Stefan Hajnoczi --- hw/virtio/virtio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 15ee3a7..7a57857 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -92,7 +92,7 @@ struct VirtQueue uint16_t queue_index; - int inuse; + unsigned int inuse; uint16_t vector; VirtIOHandleOutput handle_output; @@ -290,6 +290,7 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, void virtqueue_flush(VirtQueue *vq, unsigned int count) { uint16_t old, new; + assert(vq->inuse >= count); /* Make sure buffer is written before we update index. */ smp_wmb(); trace_virtqueue_flush(vq, count); -- 2.7.4