[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 10/19] virtio: handle virtqueue_map_desc() errors
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 10/19] virtio: handle virtqueue_map_desc() errors |
Date: |
Fri, 23 Sep 2016 22:57:28 +0300 |
From: Stefan Hajnoczi <address@hidden>
Errors can occur during virtqueue_pop(), especially in
virtqueue_map_desc(). In order to handle this we must unmap iov[]
before returning NULL. The caller will consider the virtqueue empty and
the virtio_error() call will have marked the device broken.
Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
hw/virtio/virtio.c | 74 ++++++++++++++++++++++++++++++++++++++++--------------
1 file changed, 55 insertions(+), 19 deletions(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index bac6b51..f2d6c3c 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -484,30 +484,33 @@ int virtqueue_avail_bytes(VirtQueue *vq, unsigned int
in_bytes,
return in_bytes <= in_total && out_bytes <= out_total;
}
-static void virtqueue_map_desc(unsigned int *p_num_sg, hwaddr *addr, struct
iovec *iov,
+static bool virtqueue_map_desc(VirtIODevice *vdev, unsigned int *p_num_sg,
+ hwaddr *addr, struct iovec *iov,
unsigned int max_num_sg, bool is_write,
hwaddr pa, size_t sz)
{
+ bool ok = false;
unsigned num_sg = *p_num_sg;
assert(num_sg <= max_num_sg);
if (!sz) {
- error_report("virtio: zero sized buffers are not allowed");
- exit(1);
+ virtio_error(vdev, "virtio: zero sized buffers are not allowed");
+ goto out;
}
while (sz) {
hwaddr len = sz;
if (num_sg == max_num_sg) {
- error_report("virtio: too many write descriptors in indirect
table");
- exit(1);
+ virtio_error(vdev, "virtio: too many write descriptors in "
+ "indirect table");
+ goto out;
}
iov[num_sg].iov_base = cpu_physical_memory_map(pa, &len, is_write);
if (!iov[num_sg].iov_base) {
- error_report("virtio: bogus descriptor or out of resources");
- exit(1);
+ virtio_error(vdev, "virtio: bogus descriptor or out of resources");
+ goto out;
}
iov[num_sg].iov_len = len;
@@ -517,7 +520,28 @@ static void virtqueue_map_desc(unsigned int *p_num_sg,
hwaddr *addr, struct iove
pa += len;
num_sg++;
}
+ ok = true;
+
+out:
*p_num_sg = num_sg;
+ return ok;
+}
+
+/* Only used by error code paths before we have a VirtQueueElement (therefore
+ * virtqueue_unmap_sg() can't be used). Assumes buffers weren't written to
+ * yet.
+ */
+static void virtqueue_undo_map_desc(unsigned int out_num, unsigned int in_num,
+ struct iovec *iov)
+{
+ unsigned int i;
+
+ for (i = 0; i < out_num + in_num; i++) {
+ int is_write = i >= out_num;
+
+ cpu_physical_memory_unmap(iov->iov_base, iov->iov_len, is_write, 0);
+ iov++;
+ }
}
static void virtqueue_map_iovec(struct iovec *sg, hwaddr *addr,
@@ -609,8 +633,8 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
max = vq->vring.num;
if (vq->inuse >= vq->vring.num) {
- error_report("Virtqueue size exceeded");
- exit(1);
+ virtio_error(vdev, "Virtqueue size exceeded");
+ return NULL;
}
i = head = virtqueue_get_head(vq, vq->last_avail_idx++);
@@ -621,8 +645,8 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
vring_desc_read(vdev, &desc, desc_pa, i);
if (desc.flags & VRING_DESC_F_INDIRECT) {
if (desc.len % sizeof(VRingDesc)) {
- error_report("Invalid size for indirect buffer table");
- exit(1);
+ virtio_error(vdev, "Invalid size for indirect buffer table");
+ return NULL;
}
/* loop over the indirect descriptor table */
@@ -634,22 +658,30 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
/* Collect all the descriptors */
do {
+ bool map_ok;
+
if (desc.flags & VRING_DESC_F_WRITE) {
- virtqueue_map_desc(&in_num, addr + out_num, iov + out_num,
- VIRTQUEUE_MAX_SIZE - out_num, true, desc.addr,
desc.len);
+ map_ok = virtqueue_map_desc(vdev, &in_num, addr + out_num,
+ iov + out_num,
+ VIRTQUEUE_MAX_SIZE - out_num, true,
+ desc.addr, desc.len);
} else {
if (in_num) {
- error_report("Incorrect order for descriptors");
- exit(1);
+ virtio_error(vdev, "Incorrect order for descriptors");
+ goto err_undo_map;
}
- virtqueue_map_desc(&out_num, addr, iov,
- VIRTQUEUE_MAX_SIZE, false, desc.addr, desc.len);
+ map_ok = virtqueue_map_desc(vdev, &out_num, addr, iov,
+ VIRTQUEUE_MAX_SIZE, false,
+ desc.addr, desc.len);
+ }
+ if (!map_ok) {
+ goto err_undo_map;
}
/* If we've got too many, that implies a descriptor loop. */
if ((in_num + out_num) > max) {
- error_report("Looped descriptor");
- exit(1);
+ virtio_error(vdev, "Looped descriptor");
+ goto err_undo_map;
}
} while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
@@ -669,6 +701,10 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
trace_virtqueue_pop(vq, elem, elem->in_num, elem->out_num);
return elem;
+
+err_undo_map:
+ virtqueue_undo_map_desc(out_num, in_num, iov);
+ return NULL;
}
/* Reading and writing a structure directly to QEMUFile is *awful*, but
--
MST
- [Qemu-devel] [PULL 00/19] virtio, pc: fixes and features, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 01/19] tests: add /vhost-user/connect-fail test, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 02/19] tests: add a simple /vhost-user/multiqueue test, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 03/19] tests: add /vhost-user/flags-mismatch test, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 04/19] virtio: add check for descriptor's mapped address, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 05/19] pc: clean up COMPAT macro chaining, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 06/19] target-i386: turn off CPU.l3-cache only for 2.7 and older machine types, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 09/19] virtio: migrate vdev->broken flag, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 07/19] virtio: fix stray tab character, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 08/19] virtio: stop virtqueue processing if device is broken, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 10/19] virtio: handle virtqueue_map_desc() errors,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL 12/19] virtio: use unsigned int for virtqueue_get_avail_bytes() index, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 11/19] virtio: handle virtqueue_get_avail_bytes() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 14/19] virtio: handle virtqueue_num_heads() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 15/19] virtio: handle virtqueue_get_head() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 13/19] virtio: handle virtqueue_read_next_desc() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 16/19] hw/pci: Prepare for AMD IOMMU, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 17/19] hw/i386/trace-events: Add AMD IOMMU trace events, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 19/19] hw/i386: AMD IOMMU IVRS table, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL 18/19] hw/i386: Introduce AMD IOMMU, Michael S. Tsirkin, 2016/09/23
- Re: [Qemu-devel] [PULL 00/19] virtio, pc: fixes and features, no-reply, 2016/09/23