diff mbox

[v2] qtest: virtio: zeroed last vring_desc after allocate

Message ID 1484621964-187372-1-git-send-email-longpeng2@huawei.com (mailing list archive)
State New, archived
Headers show

Commit Message

Longpeng(Mike) Jan. 17, 2017, 2:59 a.m. UTC
As qvring_indirect_desc_setup() wouldn't initialize last vring_desc,
so it's filled with dirty data, this might cause virtio backend broken.

For example, the last bit of this vring_desc's flags might be 1, so
virtqueue_read_next_desc() would report "Desc next is ***".

Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>

---
Changes since v1:
    - use writel() for @len as it's 32 bits long. [Stefan]

---
 tests/libqos/virtio.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Stefan Hajnoczi Jan. 17, 2017, 10:55 a.m. UTC | #1
On Tue, Jan 17, 2017 at 10:59:24AM +0800, Longpeng(Mike) wrote:
> As qvring_indirect_desc_setup() wouldn't initialize last vring_desc,
> so it's filled with dirty data, this might cause virtio backend broken.
> 
> For example, the last bit of this vring_desc's flags might be 1, so
> virtqueue_read_next_desc() would report "Desc next is ***".
> 
> Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>
> 
> ---
> Changes since v1:
>     - use writel() for @len as it's 32 bits long. [Stefan]
> 
> ---
>  tests/libqos/virtio.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

Thanks, applied to my block-next tree:
https://github.com/stefanha/qemu/commits/block-next

Stefan
diff mbox

Patch

diff --git a/tests/libqos/virtio.c b/tests/libqos/virtio.c
index ec30cb9..02e6a43 100644
--- a/tests/libqos/virtio.c
+++ b/tests/libqos/virtio.c
@@ -171,12 +171,20 @@  QVRingIndirectDesc *qvring_indirect_desc_setup(QVirtioDevice *d,
     for (i = 0; i < elem - 1; ++i) {
         /* indirect->desc[i].addr */
         writeq(indirect->desc + (16 * i), 0);
+        /* indirect->desc[i].len */
+        writel(indirect->desc + (16 * i) + 8, 0);
         /* indirect->desc[i].flags */
         writew(indirect->desc + (16 * i) + 12, VRING_DESC_F_NEXT);
         /* indirect->desc[i].next */
         writew(indirect->desc + (16 * i) + 14, i + 1);
     }
 
+    /* zeroed last element */
+    writeq(indirect->desc + (16 * i), 0); /* addr */
+    writel(indirect->desc + (16 * i) + 8, 0); /* len */
+    writew(indirect->desc + (16 * i) + 12, 0); /* flags */
+    writew(indirect->desc + (16 * i) + 14, 0); /* next */
+
     return indirect;
 }