The protocol for virtio-balloon stats virtqueue doesn't allow more than one element in the virtqueue.
So, instead of trying to compensate for guest misbehavior if it sends new data before the slot has been released by the host, just define the stats virtqueue length to 1 initially and rely on the generic virtio code to handle overflows. Signed-off-by: Roman Kagan <rka...@virtuozzo.com> Cc: "Michael S. Tsirkin" <m...@redhat.com> Cc: Ladi Prosek <lpro...@redhat.com> Cc: Stefan Hajnoczi <stefa...@redhat.com> --- v1 > v2: - added assert in virtio_balloon_receive_stats hw/virtio/virtio-balloon.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index 5af429a..fb8784e 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -262,12 +262,8 @@ static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq) goto out; } - if (s->stats_vq_elem != NULL) { - /* This should never happen if the driver follows the spec. */ - virtqueue_push(vq, s->stats_vq_elem, 0); - virtio_notify(vdev, vq); - g_free(s->stats_vq_elem); - } + /* enforced by stats virtqueue depth being 1 */ + assert(!s->stats_vq_elem); s->stats_vq_elem = elem; @@ -443,7 +439,7 @@ static void virtio_balloon_device_realize(DeviceState *dev, Error **errp) s->ivq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output); s->dvq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output); - s->svq = virtio_add_queue(vdev, 128, virtio_balloon_receive_stats); + s->svq = virtio_add_queue(vdev, 1, virtio_balloon_receive_stats); reset_stats(s); } -- 2.7.4