virtio: Decrement avail idx on buffer detach
authorAmit Shah <amit.shah@redhat.com>
Wed, 16 Mar 2011 13:42:10 +0000 (19:12 +0530)
committerRusty Russell <rusty@rustcorp.com.au>
Thu, 21 Apr 2011 13:27:00 +0000 (22:57 +0930)
When detaching a buffer from a vq, the avail.idx value should be
decremented as well.

This was noticed by hot-unplugging a virtio console port and then
plugging in a new one on the same number (re-using the vqs which were
just 'disowned').  qemu reported

   'Guest moved used index from 0 to 256'

when any IO was attempted on the new port.

CC: stable@kernel.org
Reported-by: juzhang <juzhang@redhat.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
drivers/virtio/virtio_ring.c

index cc2f73e03475b620053765b373c8b1a39fc08762..b0043fb26a4d5dd8fcc9a2b7b66a18b3b44053b0 100644 (file)
@@ -371,6 +371,7 @@ void *virtqueue_detach_unused_buf(struct virtqueue *_vq)
                /* detach_buf clears data, so grab it now. */
                buf = vq->data[i];
                detach_buf(vq, i);
+               vq->vring.avail->idx--;
                END_USE(vq);
                return buf;
        }