[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL v2 13/19] virtio: handle virtqueue_read_next_desc() e
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL v2 13/19] virtio: handle virtqueue_read_next_desc() errors |
Date: |
Sat, 24 Sep 2016 01:04:53 +0300 |
From: Stefan Hajnoczi <address@hidden>
Stop processing the vring if an avail ring index is invalid.
Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Cornelia Huck <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Cornelia Huck <address@hidden>
---
hw/virtio/virtio.c | 45 ++++++++++++++++++++++++++++++++-------------
1 file changed, 32 insertions(+), 13 deletions(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 973d0c2..82142c6 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -377,28 +377,33 @@ static unsigned int virtqueue_get_head(VirtQueue *vq,
unsigned int idx)
return head;
}
-static unsigned virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
- hwaddr desc_pa, unsigned int max)
-{
- unsigned int next;
+enum {
+ VIRTQUEUE_READ_DESC_ERROR = -1,
+ VIRTQUEUE_READ_DESC_DONE = 0, /* end of chain */
+ VIRTQUEUE_READ_DESC_MORE = 1, /* more buffers in chain */
+};
+static int virtqueue_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
+ hwaddr desc_pa, unsigned int max,
+ unsigned int *next)
+{
/* If this descriptor says it doesn't chain, we're done. */
if (!(desc->flags & VRING_DESC_F_NEXT)) {
- return max;
+ return VIRTQUEUE_READ_DESC_DONE;
}
/* Check they're not leading us off end of descriptors. */
- next = desc->next;
+ *next = desc->next;
/* Make sure compiler knows to grab that: we don't want it changing! */
smp_wmb();
- if (next >= max) {
- error_report("Desc next is %u", next);
- exit(1);
+ if (*next >= max) {
+ virtio_error(vdev, "Desc next is %u", *next);
+ return VIRTQUEUE_READ_DESC_ERROR;
}
- vring_desc_read(vdev, desc, desc_pa, next);
- return next;
+ vring_desc_read(vdev, desc, desc_pa, *next);
+ return VIRTQUEUE_READ_DESC_MORE;
}
void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
@@ -407,6 +412,7 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int
*in_bytes,
{
unsigned int idx;
unsigned int total_bufs, in_total, out_total;
+ int rc;
idx = vq->last_avail_idx;
@@ -459,7 +465,13 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int
*in_bytes,
if (in_total >= max_in_bytes && out_total >= max_out_bytes) {
goto done;
}
- } while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) !=
max);
+
+ rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
+ } while (rc == VIRTQUEUE_READ_DESC_MORE);
+
+ if (rc == VIRTQUEUE_READ_DESC_ERROR) {
+ goto err;
+ }
if (!indirect)
total_bufs = num_bufs;
@@ -621,6 +633,7 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
hwaddr addr[VIRTQUEUE_MAX_SIZE];
struct iovec iov[VIRTQUEUE_MAX_SIZE];
VRingDesc desc;
+ int rc;
if (unlikely(vdev->broken)) {
return NULL;
@@ -688,7 +701,13 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
virtio_error(vdev, "Looped descriptor");
goto err_undo_map;
}
- } while ((i = virtqueue_read_next_desc(vdev, &desc, desc_pa, max)) != max);
+
+ rc = virtqueue_read_next_desc(vdev, &desc, desc_pa, max, &i);
+ } while (rc == VIRTQUEUE_READ_DESC_MORE);
+
+ if (rc == VIRTQUEUE_READ_DESC_ERROR) {
+ goto err_undo_map;
+ }
/* Now copy what we have collected and mapped */
elem = virtqueue_alloc_element(sz, out_num, in_num);
--
MST
- [Qemu-devel] [PULL v2 05/19] pc: clean up COMPAT macro chaining, (continued)
- [Qemu-devel] [PULL v2 05/19] pc: clean up COMPAT macro chaining, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 07/19] virtio: fix stray tab character, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 08/19] virtio: stop virtqueue processing if device is broken, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 09/19] virtio: migrate vdev->broken flag, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 06/19] target-i386: turn off CPU.l3-cache only for 2.7 and older machine types, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 10/19] virtio: handle virtqueue_map_desc() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 11/19] virtio: handle virtqueue_get_avail_bytes() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 14/19] virtio: handle virtqueue_num_heads() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 15/19] virtio: handle virtqueue_get_head() errors, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 12/19] virtio: use unsigned int for virtqueue_get_avail_bytes() index, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 13/19] virtio: handle virtqueue_read_next_desc() errors,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL v2 16/19] hw/pci: Prepare for AMD IOMMU, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 17/19] hw/i386/trace-events: Add AMD IOMMU trace events, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 19/19] hw/i386: AMD IOMMU IVRS table, Michael S. Tsirkin, 2016/09/23
- [Qemu-devel] [PULL v2 18/19] hw/i386: Introduce AMD IOMMU, Michael S. Tsirkin, 2016/09/23
- Re: [Qemu-devel] [PULL v2 00/19] virtio, pc: fixes and features, no-reply, 2016/09/23
- Re: [Qemu-devel] [PULL v2 00/19] virtio, pc: fixes and features, Peter Maydell, 2016/09/26