Commit d65abf85 authored by Stefan Hajnoczi's avatar Stefan Hajnoczi Committed by Michael S. Tsirkin
Browse files

virtio: handle virtqueue_get_avail_bytes() errors 



If the vring is invalid, tell the caller no bytes are available and mark
the device broken.

Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: default avatarCornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: default avatarCornelia Huck <cornelia.huck@de.ibm.com>
parent ec55da19

hw/virtio/virtio.c

+11 −6
Original line number Diff line number Diff line
@@ -426,14 +426,14 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes, 


        if (desc.flags & VRING_DESC_F_INDIRECT) {

            if (desc.len % sizeof(VRingDesc)) {

                error_report("Invalid size for indirect buffer table");

                exit(1);

                virtio_error(vdev, "Invalid size for indirect buffer table");

                goto err;

            }



            /* If we've got too many, that implies a descriptor loop. */

            if (num_bufs >= max) {

                error_report("Looped descriptor");

                exit(1);

                virtio_error(vdev, "Looped descriptor");

                goto err;

            }



            /* loop over the indirect descriptor table */
@@ -447,8 +447,8 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes, 
        do {

            /* If we've got too many, that implies a descriptor loop. */

            if (++num_bufs > max) {

                error_report("Looped descriptor");

                exit(1);

                virtio_error(vdev, "Looped descriptor");

                goto err;

            }



            if (desc.flags & VRING_DESC_F_WRITE) {
@@ -473,6 +473,11 @@ done: 
    if (out_bytes) {

        *out_bytes = out_total;

    }

    return;



err:

    in_total = out_total = 0;

    goto done;

}



int virtqueue_avail_bytes(VirtQueue *vq, unsigned int in_bytes,