virtio: handle virtqueue_num_heads() errors
If the avail ring index is bogus virtqueue_num_heads() must return -EINVAL. The only caller is virtqueue_get_avail_bytes(). Return saying no bytes are available when virtqueue_num_heads() fails. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
This commit is contained in:
parent
412e0e81b1
commit
4355c1abca
|
@ -347,9 +347,9 @@ static int virtqueue_num_heads(VirtQueue *vq, unsigned int idx)
|
||||||
|
|
||||||
/* Check it isn't doing very strange things with descriptor numbers. */
|
/* Check it isn't doing very strange things with descriptor numbers. */
|
||||||
if (num_heads > vq->vring.num) {
|
if (num_heads > vq->vring.num) {
|
||||||
error_report("Guest moved used index from %u to %u",
|
virtio_error(vq->vdev, "Guest moved used index from %u to %u",
|
||||||
idx, vq->shadow_avail_idx);
|
idx, vq->shadow_avail_idx);
|
||||||
exit(1);
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
/* On success, callers read a descriptor at vq->last_avail_idx.
|
/* On success, callers read a descriptor at vq->last_avail_idx.
|
||||||
* Make sure descriptor read does not bypass avail index read. */
|
* Make sure descriptor read does not bypass avail index read. */
|
||||||
|
@ -417,7 +417,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
|
||||||
idx = vq->last_avail_idx;
|
idx = vq->last_avail_idx;
|
||||||
|
|
||||||
total_bufs = in_total = out_total = 0;
|
total_bufs = in_total = out_total = 0;
|
||||||
while (virtqueue_num_heads(vq, idx)) {
|
while ((rc = virtqueue_num_heads(vq, idx)) > 0) {
|
||||||
VirtIODevice *vdev = vq->vdev;
|
VirtIODevice *vdev = vq->vdev;
|
||||||
unsigned int max, num_bufs, indirect = 0;
|
unsigned int max, num_bufs, indirect = 0;
|
||||||
VRingDesc desc;
|
VRingDesc desc;
|
||||||
|
@ -478,6 +478,11 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
|
||||||
else
|
else
|
||||||
total_bufs++;
|
total_bufs++;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (rc < 0) {
|
||||||
|
goto err;
|
||||||
|
}
|
||||||
|
|
||||||
done:
|
done:
|
||||||
if (in_bytes) {
|
if (in_bytes) {
|
||||||
*in_bytes = in_total;
|
*in_bytes = in_total;
|
||||||
|
|
Loading…
Reference in a new issue