From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41458) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YWNVX-0006kt-9t for qemu-devel@nongnu.org; Fri, 13 Mar 2015 07:12:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YWNLy-0006R9-Gd for qemu-devel@nongnu.org; Fri, 13 Mar 2015 07:02:07 -0400 Message-ID: <5502C3A2.3060902@redhat.com> Date: Fri, 13 Mar 2015 12:01:54 +0100 From: Paolo Bonzini MIME-Version: 1.0 References: <1426233354-525-1-git-send-email-famz@redhat.com> In-Reply-To: <1426233354-525-1-git-send-email-famz@redhat.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] virtio-scsi: Fix assert in virtio_scsi_push_event List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Fam Zheng , qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org On 13/03/2015 08:55, Fam Zheng wrote: > Hotplugging a scsi-disk may trigger the assertion in qemu_sgl_concat. > > qemu-system-x86_64: qemu/hw/scsi/virtio-scsi.c:115: qemu_sgl_concat: > Assertion `skip == 0' failed. > > This is introduced by commit 55783a55 (virtio-scsi: work around bug in > old BIOSes) which didn't check out_num when accessing out_sg[0].iov_len > (the same to in sg). For virtio_scsi_push_event, looking into out_sg > doesn't make sense because 0 req_size is intended. > > Cc: qemu-stable@nongnu.org > [Cc'ing qemu-stable because 55783a55 did it too] > Signed-off-by: Fam Zheng > --- > hw/scsi/virtio-scsi.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c > index da0cff8..c9bea06 100644 > --- a/hw/scsi/virtio-scsi.c > +++ b/hw/scsi/virtio-scsi.c > @@ -146,8 +146,12 @@ static int virtio_scsi_parse_req(VirtIOSCSIReq *req, > * TODO: always disable this workaround for virtio 1.0 devices. > */ > if (!virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) { > - req_size = req->elem.out_sg[0].iov_len; > - resp_size = req->elem.in_sg[0].iov_len; > + if (req->elem.out_num) { > + req_size = req->elem.out_sg[0].iov_len; > + } > + if (req->elem.in_num) { > + resp_size = req->elem.in_sg[0].iov_len; > + } > } > > out_size = qemu_sgl_concat(req, req->elem.out_sg, > Thanks, I'll send a pull request next week. Paolo