diff options
| author | Fam Zheng <famz@redhat.com> | 2015-03-13 15:55:54 +0800 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2015-03-18 12:07:27 +0100 |
| commit | 2034e324dabc55064553aaa07de1536ebf8ea497 (patch) | |
| tree | fd8cff5843693533f285ed0db5fe13cdf070517f /hw/scsi/virtio-scsi.c | |
| parent | 15564d85afaf1d7b314c858a5a34bda599f4cd14 (diff) | |
| download | hqemu-2034e324dabc55064553aaa07de1536ebf8ea497.zip hqemu-2034e324dabc55064553aaa07de1536ebf8ea497.tar.gz | |
virtio-scsi: Fix assert in virtio_scsi_push_event
Hotplugging a scsi-disk may trigger the assertion in qemu_sgl_concat.
qemu-system-x86_64: qemu/hw/scsi/virtio-scsi.c:115: qemu_sgl_concat:
Assertion `skip == 0' failed.
This is introduced by commit 55783a55 (virtio-scsi: work around bug in
old BIOSes) which didn't check out_num when accessing out_sg[0].iov_len
(the same to in sg). For virtio_scsi_push_event, looking into out_sg
doesn't make sense because 0 req_size is intended.
Cc: qemu-stable@nongnu.org
[Cc'ing qemu-stable because 55783a55 did it too]
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <1426233354-525-1-git-send-email-famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/scsi/virtio-scsi.c')
| -rw-r--r-- | hw/scsi/virtio-scsi.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index da0cff8..c9bea06 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -146,8 +146,12 @@ static int virtio_scsi_parse_req(VirtIOSCSIReq *req, * TODO: always disable this workaround for virtio 1.0 devices. */ if (!virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) { - req_size = req->elem.out_sg[0].iov_len; - resp_size = req->elem.in_sg[0].iov_len; + if (req->elem.out_num) { + req_size = req->elem.out_sg[0].iov_len; + } + if (req->elem.in_num) { + resp_size = req->elem.in_sg[0].iov_len; + } } out_size = qemu_sgl_concat(req, req->elem.out_sg, |
