ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

virtio: handle virtqueue_read_next_desc() errors 

Stop processing the vring if an avail ring index is invalid.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
This commit is contained in:
Stefan Hajnoczi 2016-09-21 16:52:24 +01:00 committed by Michael S. Tsirkin
parent b1c7c07f2d
commit 412e0e81b1
1 changed files with 32 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
hw/virtio/virtio.c
View File

@ -377,28 +377,33 @@ static unsigned int virtqueue_get_head(VirtQueue *vq, unsigned int idx)
return head; return head;
} }
static unsigned virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc, enum {
hwaddr desc_pa, unsigned int max) VIRTQUEUE_READ_DESC_ERROR = -1,
{ VIRTQUEUE_READ_DESC_DONE = 0, /* end of chain */
unsigned int next; VIRTQUEUE_READ_DESC_MORE = 1, /* more buffers in chain */
};
static int virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
hwaddr desc_pa, unsigned int max,
unsigned int *next)
{
/* If this descriptor says it doesn't chain, we're done. */ /* If this descriptor says it doesn't chain, we're done. */
if (!(desc->flags & VRING_DESC_F_NEXT)) { if (!(desc->flags & VRING_DESC_F_NEXT)) {
return max; return VIRTQUEUE_READ_DESC_DONE;
} }
/* Check they're not leading us off end of descriptors. */ /* Check they're not leading us off end of descriptors. */
next = desc->next; *next = desc->next;
/* Make sure compiler knows to grab that: we don't want it changing! */ /* Make sure compiler knows to grab that: we don't want it changing! */
smp_wmb(); smp_wmb();
if (next >= max) { if (*next >= max) {
error_report("Desc next is %u", next); virtio_error(vdev, "Desc next is %u", *next);
exit(1); return VIRTQUEUE_READ_DESC_ERROR;
} }
vring_desc_read(vdev, desc, desc_pa, next); vring_desc_read(vdev, desc, desc_pa, *next);
return next; return VIRTQUEUE_READ_DESC_MORE;
} }
void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes, void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
@ -407,6 +412,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
{ {
unsigned int idx; unsigned int idx;
unsigned int total_bufs, in_total, out_total; unsigned int total_bufs, in_total, out_total;
int rc;
idx = vq->last_avail_idx; idx = vq->last_avail_idx;
@ -459,7 +465,13 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
if (in_total >= max_in_bytes && out_total >= max_out_bytes) { if (in_total >= max_in_bytes && out_total >= max_out_bytes) {
goto done; goto done;
} }
} while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
} while (rc == VIRTQUEUE_READ_DESC_MORE);
if (rc == VIRTQUEUE_READ_DESC_ERROR) {
goto err;
}
if (!indirect) if (!indirect)
total_bufs = num_bufs; total_bufs = num_bufs;
@ -621,6 +633,7 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
hwaddr addr[VIRTQUEUE_MAX_SIZE]; hwaddr addr[VIRTQUEUE_MAX_SIZE];
struct iovec iov[VIRTQUEUE_MAX_SIZE]; struct iovec iov[VIRTQUEUE_MAX_SIZE];
VRingDesc desc; VRingDesc desc;
int rc;
if (unlikely(vdev->broken)) { if (unlikely(vdev->broken)) {
return NULL; return NULL;
@ -688,7 +701,13 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
virtio_error(vdev, "Looped descriptor"); virtio_error(vdev, "Looped descriptor");
goto err_undo_map; goto err_undo_map;
} }
} while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
} while (rc == VIRTQUEUE_READ_DESC_MORE);
if (rc == VIRTQUEUE_READ_DESC_ERROR) {
goto err_undo_map;
}
/* Now copy what we have collected and mapped */ /* Now copy what we have collected and mapped */
elem = virtqueue_alloc_element(sz, out_num, in_num); elem = virtqueue_alloc_element(sz, out_num, in_num);