From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:52591) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S8ZlZ-0002CL-SM for qemu-devel@nongnu.org; Fri, 16 Mar 2012 12:12:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1S8ZlS-0004qs-Rl for qemu-devel@nongnu.org; Fri, 16 Mar 2012 12:12:33 -0400 Received: from mail-pz0-f45.google.com ([209.85.210.45]:57188) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1S8ZlS-0004oe-Lb for qemu-devel@nongnu.org; Fri, 16 Mar 2012 12:12:26 -0400 Received: by dadp14 with SMTP id p14so6477533dad.4 for ; Fri, 16 Mar 2012 09:12:24 -0700 (PDT) Message-ID: <4F636664.5090505@redhat.com> Date: Fri, 16 Mar 2012 11:12:20 -0500 From: Anthony Liguori MIME-Version: 1.0 References: <1331845217-21705-1-git-send-email-mjt@msgid.tls.msk.ru> <1331845217-21705-2-git-send-email-mjt@msgid.tls.msk.ru> In-Reply-To: <1331845217-21705-2-git-send-email-mjt@msgid.tls.msk.ru> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCHv4 01/11] virtio-serial-bus: use correct lengths in control_out() message List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Michael Tokarev Cc: Paolo Bonzini , qemu-devel@nongnu.org On 03/15/2012 04:00 PM, Michael Tokarev wrote: > In case of more than one control message, the code will use > size of the largest message so far for all subsequent messages, > instead of using size of current one. Fix it. > > Signed-off-by: Michael Tokarev > --- > hw/virtio-serial-bus.c | 6 +++--- > 1 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c > index e22940e..abe48ec 100644 > --- a/hw/virtio-serial-bus.c > +++ b/hw/virtio-serial-bus.c > @@ -454,7 +454,7 @@ static void control_out(VirtIODevice *vdev, VirtQueue *vq) > len = 0; > buf = NULL; > while (virtqueue_pop(vq,&elem)) { > - size_t cur_len, copied; > + size_t cur_len; > > cur_len = iov_size(elem.out_sg, elem.out_num); > /* > @@ -467,9 +467,9 @@ static void control_out(VirtIODevice *vdev, VirtQueue *vq) > buf = g_malloc(cur_len); > len = cur_len; > } > - copied = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, len); > + iov_to_buf(elem.out_sg, elem.out_num, buf, 0, cur_len); I don't understand what this is fixing. copied = cur_len unless for some reason a full copy couldn't be done. But you're assuming a full copy is done. So I'm confused by what is being fixed here. Regards, Anthony Liguori > - handle_control_message(vser, buf, copied); > + handle_control_message(vser, buf, cur_len); > virtqueue_push(vq,&elem, 0); > } > g_free(buf);