[PATCH] fix bug in virtio-rng

[PATCH] fix bug in virtio-rng

[Christian Borntraeger]

Rusty,

I have seen an oops triggered by the following bug statement in 
virtio-rng:

if (vq->vq_ops->add_buf(vq, &sg, 0, 1, &random_data) != 0)
	BUG();

The problem is that we never called get_buf for complete buffers.

The fix is simple: We have to free the buffer on interrupt to 
avoid a virtqueue "overflow".

Christian

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>


---
 drivers/char/hw_random/virtio-rng.c |    3 +++
 1 file changed, 3 insertions(+)

Index: kvm/drivers/char/hw_random/virtio-rng.c
===================================================================
--- kvm.orig/drivers/char/hw_random/virtio-rng.c
+++ kvm/drivers/char/hw_random/virtio-rng.c
@@ -29,6 +29,9 @@ static bool have_data;
 
 static void random_recv_done(struct virtqueue *vq)
 {
+	int len = 0;
+	vq->vq_ops->get_buf(vq, &len);
+	BUG_ON(!len);
 	have_data = true;
 
 	/* No need to call disable_cb: there can't be any more since we
-- 
IBM Deutschland Entwicklung GmbH
Vorsitzender des Aufsichtsrats: Martin Jetter
Geschäftsführung: Herbert Kircher 
Sitz der Gesellschaft: Böblingen
Registergericht: Amtsgericht Stuttgart, HRB 243294

Re: [PATCH] fix bug in virtio-rng

[Rusty Russell]

On Tuesday 15 January 2008 04:31:35 Christian Borntraeger wrote:
> Rusty,
>
> I have seen an oops triggered by the following bug statement in
> virtio-rng:
>
> if (vq->vq_ops->add_buf(vq, &sg, 0, 1, &random_data) != 0)
> 	BUG();
>
> The problem is that we never called get_buf for complete buffers.
>
> The fix is simple: We have to free the buffer on interrupt to
> avoid a virtqueue "overflow".

Thanks, applied.

Rusty.