From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56919) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1baq99-0004DH-Ke for qemu-devel@nongnu.org; Fri, 19 Aug 2016 16:12:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1baq94-0004uv-Kq for qemu-devel@nongnu.org; Fri, 19 Aug 2016 16:12:06 -0400 Received: from mail-he1eur01on0119.outbound.protection.outlook.com ([104.47.0.119]:19880 helo=EUR01-HE1-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1baq94-0004uq-3V for qemu-devel@nongnu.org; Fri, 19 Aug 2016 16:12:02 -0400 From: Roman Kagan Date: Fri, 19 Aug 2016 16:39:20 +0300 Message-ID: <1471613966-7267-2-git-send-email-rkagan@virtuozzo.com> In-Reply-To: <1471613966-7267-1-git-send-email-rkagan@virtuozzo.com> References: <1471613966-7267-1-git-send-email-rkagan@virtuozzo.com> MIME-Version: 1.0 Content-Type: text/plain Subject: [Qemu-devel] [PATCH v2 1/6] virtio: assert on ->inuse underflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: "Denis V. Lunev" , Roman Kagan , "Michael S. Tsirkin" , Ladi Prosek , Stefan Hajnoczi Make sure that ->inuse counter on virtqueue never goes negative. This complements commit afd9096eb1882f23929f5b5c177898ed231bac66, "virtio: error out if guest exceeds virtqueue size", which, due to signed ->inuse comparison against unsigned ->vring.num, manifested a bug in virtio-balloon where virtqueue_push() was called before the matching virtqueu_pop(). [That problem will be addressed in followup patches]. Signed-off-by: Roman Kagan Cc: "Michael S. Tsirkin" Cc: Ladi Prosek Cc: Stefan Hajnoczi --- hw/virtio/virtio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 15ee3a7..7a57857 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -92,7 +92,7 @@ struct VirtQueue uint16_t queue_index; - int inuse; + unsigned int inuse; uint16_t vector; VirtIOHandleOutput handle_output; @@ -290,6 +290,7 @@ void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem, void virtqueue_flush(VirtQueue *vq, unsigned int count) { uint16_t old, new; + assert(vq->inuse >= count); /* Make sure buffer is written before we update index. */ smp_wmb(); trace_virtqueue_flush(vq, count); -- 2.7.4