Re: [Qemu-devel] [PATCH] scsi: pvscsi: limit process IO loop to maximum page count

[Dmitry Fleytman <dmitry@daynix.com>]

Hello Prasad,

Please see my questions inline.

> On 13 Sep 2016, at 10:00 AM, P J P <ppandit@redhat.com> wrote:
> 
> +-- On Wed, 7 Sep 2016, P J P wrote --+
> | From: Prasad J Pandit <pjp@fedoraproject.org>
> | 
> | Vmware Paravirtual SCSI emulator while processing IO requests
> | could run into an infinite loop if 'pvscsi_ring_pop_req_descr'
> | always returned positive value. Limit IO loop to the maximum

Do you see any specific scenario why this might happen?

> | page count.
> | 
> | Reported-by: Li Qiang <liqiang6-s@360.cn>
> | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> | ---
> |  hw/scsi/vmw_pvscsi.c | 4 +++-
> |  1 file changed, 3 insertions(+), 1 deletion(-)
> | 
> | diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
> | index babac5a..3e77a08 100644
> | --- a/hw/scsi/vmw_pvscsi.c
> | +++ b/hw/scsi/vmw_pvscsi.c
> | @@ -711,11 +711,13 @@ pvscsi_process_request_descriptor(PVSCSIState *s,
> |  static void
> |  pvscsi_process_io(PVSCSIState *s)
> |  {
> | +    int descr_pa_cnt = 0;
> |      PVSCSIRingReqDesc descr;
> |      hwaddr next_descr_pa;
> |  
> |      assert(s->rings_info_valid);
> | -    while ((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0) {
> | +    while (((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0)
> | +            && descr_pa_cnt++ < PVSCSI_SETUP_RINGS_MAX_NUM_PAGES) {

Why do you limit number of processed descriptors by maximal number of pages in data exchange ring?
What will happen to requests still waiting in the ring after this function exits?

Thanks,
Dmitry

> |  
> |          /* Only read after production index verification */
> |          smp_rmb();
> 
> Ping...!
> --
> Prasad J Pandit / Red Hat Product Security Team
> 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F