diff mbox

[PULL,2/4] xen: fix quad word bufioreq handling

Message ID 1480362146-14873-2-git-send-email-sstabellini@kernel.org
State New
Headers show

Commit Message

Stefano Stabellini Nov. 28, 2016, 7:42 p.m. UTC 
From: Jan Beulich <JBeulich@suse.com>

We should not consume the second slot if it didn't get written yet.
Normal writers - i.e. Xen - would not update write_pointer between the
two writes, but the page may get fiddled with by the guest itself, and
we're better off avoiding to enter an infinite loop in that case.

Reported-by: yanghongke <yanghongke@huawei.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
---
 xen-hvm.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox

Patch

diff --git a/xen-hvm.c b/xen-hvm.c
index 99b8ee8..d74e233 100644
--- a/xen-hvm.c
+++ b/xen-hvm.c
@@ -1021,6 +1021,9 @@  static int handle_buffered_iopage(XenIOState *state)
         xen_rmb();
         qw = (req.size == 8);
         if (qw) {
+            if (rdptr + 1 == wrptr) {
+                hw_error("Incomplete quad word buffered ioreq");
+            }
             buf_req = &buf_page->buf_ioreq[(rdptr + 1) %
                                            IOREQ_BUFFER_SLOT_NUM];
             req.data |= ((uint64_t)buf_req->data) << 32;