From: Prasad J Pandit <p...@fedoraproject.org>
Vmware Paravirtual SCSI emulator while processing IO requests
could run into an infinite loop if 'pvscsi_ring_pop_req_descr'
always returned positive value. Limit IO loop to the maximum
page count.
Reported-by: Li Qiang <liqiang...@360.cn>
Signed-off-by: Prasad J Pandit <p...@fedoraproject.org>
---
hw/scsi/vmw_pvscsi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index babac5a..3e77a08 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -711,11 +711,13 @@ pvscsi_process_request_descriptor(PVSCSIState *s,
static void
pvscsi_process_io(PVSCSIState *s)
{
+ int descr_pa_cnt = 0;
PVSCSIRingReqDesc descr;
hwaddr next_descr_pa;
assert(s->rings_info_valid);
- while ((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0) {
+ while (((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0)
+ && descr_pa_cnt++ < PVSCSI_SETUP_RINGS_MAX_NUM_PAGES) {
/* Only read after production index verification */
smp_rmb();
--
2.5.5
