Subject: fix bug in virtio-rng Date: Mon, 14 Jan 2008 18:31:35 +0100 From: Christian Borntraeger Rusty, I have seen an oops triggered by the following bug statement in virtio-rng: if (vq->vq_ops->add_buf(vq, &sg, 0, 1, &random_data) != 0) BUG(); The problem is that we never called get_buf for complete buffers. The fix is simple: We have to free the buffer on interrupt to avoid a virtqueue "overflow". Christian Signed-off-by: Christian Borntraeger Signed-off-by: Rusty Russell --- drivers/char/hw_random/virtio-rng.c | 3 +++ 1 file changed, 3 insertions(+) Index: kvm/drivers/char/hw_random/virtio-rng.c =================================================================== --- kvm.orig/drivers/char/hw_random/virtio-rng.c +++ kvm/drivers/char/hw_random/virtio-rng.c @@ -29,6 +29,9 @@ static bool have_data; static void random_recv_done(struct virtqueue *vq) { + int len = 0; + vq->vq_ops->get_buf(vq, &len); + BUG_ON(!len); have_data = true; /* No need to call disable_cb: there can't be any more since we