[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL v2 15/19] virtio: handle virtqueue_get_head() errors
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL v2 15/19] virtio: handle virtqueue_get_head() errors |
Date: |
Sat, 24 Sep 2016 01:04:55 +0300 |
From: Stefan Hajnoczi <address@hidden>
Stop processing the vring if virtqueue_get_head() fetches an
out-of-bounds head index.
Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Cornelia Huck <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Cornelia Huck <address@hidden>
---
hw/virtio/virtio.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index b7ac356..18ce333 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -360,21 +360,20 @@ static int virtqueue_num_heads(VirtQueue *vq, unsigned
int idx)
return num_heads;
}
-static unsigned int virtqueue_get_head(VirtQueue *vq, unsigned int idx)
+static bool virtqueue_get_head(VirtQueue *vq, unsigned int idx,
+ unsigned int *head)
{
- unsigned int head;
-
/* Grab the next descriptor number they're advertising, and increment
* the index we've seen. */
- head = vring_avail_ring(vq, idx % vq->vring.num);
+ *head = vring_avail_ring(vq, idx % vq->vring.num);
/* If their number is silly, that's a fatal mistake. */
- if (head >= vq->vring.num) {
- error_report("Guest says index %u is available", head);
- exit(1);
+ if (*head >= vq->vring.num) {
+ virtio_error(vq->vdev, "Guest says index %u is available", *head);
+ return false;
}
- return head;
+ return true;
}
enum {
@@ -426,7 +425,11 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int
*in_bytes,
max = vq->vring.num;
num_bufs = total_bufs;
- i = virtqueue_get_head(vq, idx++);
+
+ if (!virtqueue_get_head(vq, idx++, &i)) {
+ goto err;
+ }
+
desc_pa = vq->vring.desc;
vring_desc_read(vdev, &desc, desc_pa, i);
@@ -660,11 +663,15 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
return NULL;
}
- i = head = virtqueue_get_head(vq, vq->last_avail_idx++);
+ if (!virtqueue_get_head(vq, vq->last_avail_idx++, &head)) {
+ return NULL;
+ }
+
if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
vring_set_avail_event(vq, vq->last_avail_idx);
}
+ i = head;
vring_desc_read(vdev, &desc, desc_pa, i);
if (desc.flags & VRING_DESC_F_INDIRECT) {
if (desc.len % sizeof(VRingDesc)) {
--
MST
- [Qemu-devel] [PULL v2 03/19] tests: add /vhost-user/flags-mismatch test, (continued)
- [Qemu-devel] [PULL v2 03/19] tests: add /vhost-user/flags-mismatch test, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 04/19] virtio: add check for descriptor's mapped address, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 05/19] pc: clean up COMPAT macro chaining, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 07/19] virtio: fix stray tab character, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 08/19] virtio: stop virtqueue processing if device is broken, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 09/19] virtio: migrate vdev->broken flag, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 06/19] target-i386: turn off CPU.l3-cache only for 2.7 and older machine types, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 10/19] virtio: handle virtqueue_map_desc() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 11/19] virtio: handle virtqueue_get_avail_bytes() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 14/19] virtio: handle virtqueue_num_heads() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 15/19] virtio: handle virtqueue_get_head() errors,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL v2 12/19] virtio: use unsigned int for virtqueue_get_avail_bytes() index, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 13/19] virtio: handle virtqueue_read_next_desc() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 16/19] hw/pci: Prepare for AMD IOMMU, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 17/19] hw/i386/trace-events: Add AMD IOMMU trace events, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 19/19] hw/i386: AMD IOMMU IVRS table, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 18/19] hw/i386: Introduce AMD IOMMU, Michael S. Tsirkin, 2016/09/23
- Re: [Qemu-devel] [PULL v2 00/19] virtio, pc: fixes and features, no-reply, 2016/09/23
- Re: [Qemu-devel] [PULL v2 00/19] virtio, pc: fixes and features, Peter Maydell, 2016/09/26