virtio-scsi: Fix assert in virtio_scsi_push_event
Hotplugging a scsi-disk may trigger the assertion in qemu_sgl_concat. qemu-system-x86_64: qemu/hw/scsi/virtio-scsi.c:115: qemu_sgl_concat: Assertion `skip == 0' failed. This is introduced by commit55783a55
(virtio-scsi: work around bug in old BIOSes) which didn't check out_num when accessing out_sg[0].iov_len (the same to in sg). For virtio_scsi_push_event, looking into out_sg doesn't make sense because 0 req_size is intended. Cc: qemu-stable@nongnu.org [Cc'ing qemu-stable because55783a55
did it too] Signed-off-by: Fam Zheng <famz@redhat.com> Message-Id: <1426233354-525-1-git-send-email-famz@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
15564d85af
commit
2034e324da
|
@ -146,8 +146,12 @@ static int virtio_scsi_parse_req(VirtIOSCSIReq *req,
|
||||||
* TODO: always disable this workaround for virtio 1.0 devices.
|
* TODO: always disable this workaround for virtio 1.0 devices.
|
||||||
*/
|
*/
|
||||||
if (!virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
|
if (!virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) {
|
||||||
req_size = req->elem.out_sg[0].iov_len;
|
if (req->elem.out_num) {
|
||||||
resp_size = req->elem.in_sg[0].iov_len;
|
req_size = req->elem.out_sg[0].iov_len;
|
||||||
|
}
|
||||||
|
if (req->elem.in_num) {
|
||||||
|
resp_size = req->elem.in_sg[0].iov_len;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
out_size = qemu_sgl_concat(req, req->elem.out_sg,
|
out_size = qemu_sgl_concat(req, req->elem.out_sg,
|
||||||
|
|
Loading…
Reference in a new issue