xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2025-02-11 23:27:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

virtio: handle virtqueue_num_heads() errors

Browse Source 
If the avail ring index is bogus virtqueue_num_heads() must return
-EINVAL.

The only caller is virtqueue_get_avail_bytes().  Return saying no bytes
are available when virtqueue_num_heads() fails.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
This commit is contained in:
Stefan Hajnoczi 2016-09-21 16:52:25 +01:00 committed by Michael S. Tsirkin
parent 412e0e81b1
commit 4355c1abca
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hw/virtio/virtio.c
View File

@ -347,9 +347,9 @@ static int virtqueue_num_heads(VirtQueue *vq, unsigned int idx)
/* Check it isn't doing very strange things with descriptor numbers. */ /* Check it isn't doing very strange things with descriptor numbers. */
if (num_heads > vq->vring.num) { if (num_heads > vq->vring.num) {
error_report("Guest moved used index from %u to %u", virtio_error(vq->vdev, "Guest moved used index from %u to %u",
idx, vq->shadow_avail_idx); idx, vq->shadow_avail_idx);
exit(1); return -EINVAL;
} }
/* On success, callers read a descriptor at vq->last_avail_idx. /* On success, callers read a descriptor at vq->last_avail_idx.
* Make sure descriptor read does not bypass avail index read. */ * Make sure descriptor read does not bypass avail index read. */
@ -417,7 +417,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
idx = vq->last_avail_idx; idx = vq->last_avail_idx;
total_bufs = in_total = out_total = 0; total_bufs = in_total = out_total = 0;
while (virtqueue_num_heads(vq, idx)) { while ((rc = virtqueue_num_heads(vq, idx)) > 0) {
VirtIODevice *vdev = vq->vdev; VirtIODevice *vdev = vq->vdev;
unsigned int max, num_bufs, indirect = 0; unsigned int max, num_bufs, indirect = 0;
VRingDesc desc; VRingDesc desc;
@ -478,6 +478,11 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
else else
total_bufs++; total_bufs++;
} }
if (rc < 0) {
goto err;
}
done: done:
if (in_bytes) { if (in_bytes) {
*in_bytes = in_total; *in_bytes = in_total;