From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54765) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bgrqr-0005KA-LQ for qemu-devel@nongnu.org; Mon, 05 Sep 2016 07:14:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bgrqn-0002ah-Cl for qemu-devel@nongnu.org; Mon, 05 Sep 2016 07:14:08 -0400 Received: from mx1.redhat.com ([209.132.183.28]:54742) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bgrqn-0002ac-7O for qemu-devel@nongnu.org; Mon, 05 Sep 2016 07:14:05 -0400 Date: Mon, 5 Sep 2016 16:43:59 +0530 (IST) From: P J P In-Reply-To: Message-ID: References: <1472884428-9975-1-git-send-email-ppandit@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Subject: Re: [Qemu-devel] [PATCH] scsi: pvscsi: request descriptor data_length to 32 bit List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini Cc: Qemu Developers , Dmitry Fleytman , Li Qiang +-- On Mon, 5 Sep 2016, Paolo Bonzini wrote --+ | No, that's not what happens. chunk_size is set to sg.resid, after which: | | sg.dataAddr += chunk_size; | data_length -= chunk_size; | sg.resid -= chunk_size; | | The loop is reentered with sg.resid == 0, it calls into | pvscsi_get_next_sg_elem and this sets sg.resid to a nonzero value. It's | not an infinite loop. Yes, true; But 'pvscsi_get_next_sg_elem' does not return non-zero 'sg.resid' each time. In fact, it returns more zeros and thus the loop iterates infinitely. When I ran it with 64 bit 'data_length' and without cast, after some time, the inner loop gets stuck and does not seem to read non-zero values into 'sg.resid'. Is there limit to number of SG elements? | The driver is irrelevant. If the data_length is an uint64_t you need to | ensure that a 64 bit buffer is processed correctly. Here you are | truncating it, which is wrong and will cause a buffer underrun. Yes. I thought truncation in MIN was intentional, considering the driver sets 'dataLen' to 32 bit value. If we are to go with 64 bit 'data_length', how long should the inner while loop run? Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F